“Suppose two parties have hash functions h1 and h2 respectively, but each only trusts the security of their own. We wish to build a hash combiner Cʰ¹,ʰ² which is secure so long as either one of the underlying hash functions is. … In this case, concatenating the two hash outputs clearly works. Unfortunately, a long series of works … showed no (noticeably) shorter combiner for collision resistance is possible. … We argue the right formulation of the “hash combiner” is what we call random oracle (RO) combiners.”

Find the paper and full list of authors at Cryptology ePrint Archive.