Is there a standard way to extend the output of a hash? Say I have a hash function, a state-of-the-art hash function that we would all approve of that produces a fixed number of bits (n) as output. (I'll call it HASH.)

Is there are a standard way to produce a different number of bits from this building block? (I'd prefer it if HASH is treated as a black-box component that can't be modified internally.)

If I wanted less than n, I could just use as many bits from the output I want, ignoring the rest. (I think SHA-224 does this internally.) But what if I want more than n?

Or to put it another way, can I call (say) SHA256 sixteen times and produce something that's just as good (other than for speed) as a hypothetical SHA4096 would be?
If you assume the hash function as block box with no known preimage attack, then you can do the following to get a "more secure" hash:


You have a message $m$ and a hash function $h(\cdot)$, and you want to extend the hash length by factor $k$.
Assuming the hash function as block box, you don't change anything if you add a fixed prefix or suffix to the input string.
However, if the prefix or suffix is different, you will get a random different output.
Therefore if you have e.g. $h_0=h(m|0)$ and $h_1=(m|1)$, it should be even harder to find a common preimage $m$ than for a single hash function. But I have no idea how much harder it actually gets. But if you assume a random oracle for the hash function, and find a preimage for $h(m)$  after testing $x$ values in average, the common preimage should be found after testing $x^2$ values.


This leaves us with this formula (the suffix number inside the hash functions should be fixed size bitstrings):
$h'(m):=h(m|1)\,|\,h(m|2)\,|\,...\,|\,h(m|k)$

Finding a preimage or a collision then is not reduced to finding a match for a single input to the hash function but to several.