“Suppose two parties have hash functions h1 and h2 respectively, but each only trusts the security of their own. We wish to build a hash combiner Cʰ¹,ʰ² which is secure so long as either one of the underlying hash functions is. … Unfortunately, a long series of works … showed no (noticeably) shorter combiner for collision resistance is possible. We revisit this pessimistic state of affairs. … We argue the right formulation of the ‘hash combiner’ is what we call random oracle (RO) combiners.”

Find the paper and full list of authors at Cryptology ePrint Archive.