How much original entropy is lost if a part of the hash is known? You have an entropy source of n bits
You hash it with SHA-512 for example
k bits of the SHA-512 output are publicly revealed, but the SHA-512 hash is also a private key to be protected (k&lt;=512)


The question is how many bits are lost in the original entropy source by revealing/losing k bits in the hash?

Especially: the original entropy source has less entropy than the hash output size. Because if it has more or the same as the hash output then it will be equivallent to 512-k, the question is… what if it's less?
A good hash function like SHA-512 is thought to behave like a random oracle and reveal nothing about it's input, however if the source has less potential entropy (fewer bytes) than the hash output size then this can be exploited as a potential search problem.

If the original source has fewer bytes than the hash output size, and this number of bytes is a computationally feasible search problem (i.e. &lt; 80 bytes) then revealing k bytes of the hash is equivalent to revealing up to k bytes of the input source, since the candidate preimages of the output can be found.

Thinking about the scenario in which fewer bytes of the hash are revealed than there are bytes of entropy in the input source, there will be many inputs which map to the same abbreviated hash output. Ideally however these inputs would be a random distribution from the input source and not reveal any of the source entropy until the hash output size was equal to the input size. 

Extending this idea further it's obvious that something about the input entropy is revealed, since as the number of bytes revealed approaches the number of bytes input the number of possible preimages is reduced which reduces the entropy until the stage that there is none and we have (ideally) only one preimage. 

I modelled this and found experimentally that for SHA512 the amount of entropy about the input which is lost for each byte of the hash function output known is approximately (ideally) one byte. This makes sense in the context of the definition of a cryptographic hash algorithm. 

e.g.

Input value with 6 nibbles of potential entropy: $9840563$ 

First 6 SHA512 nibbles: $8ae967$

$8: 1049140 \approx 2^{20}$

$8a: 65275 \approx 2^{16}$

$8ae: 4099 \approx 2^{12}$

$8ae9: 270 \approx 2^{8}$

$8ae96: 13 \approx 2^{4}$

$8ae967: 1 = 1$