Is there a way to slow down collision attacks using iteration? The simple way to iterate a hash function $H(H(m))$ only makes brute force preimage finding slower, but leaves collision attacks as fast since a collision in the inner hash function is a collision in the overall function.

Is there an iterative algorithm that also slows down brute force collision attacks? Without expanding the output size?

I am looking for something that reduces to the standard properties of the hash function, rather than only working for an ideal hash or a random oracle.



The use case is that a short hash is used, e.g. 128 bits with 64-bit collision resistance. Collision finding attacks should be slowed down sufficiently to be infeasible, e.g. to $2^{100}$ hash function calls.
As others have pointed out in the comments, using the message in the hash iteration can dissolve collisions in the inner hash again. Additionally, the round number can also be used, in case you have collisions over different rounds. But concatentation is just one possible way to combine these values as input.

If your assumption is just a general hash function, you should have a function $f$, and then set:


$h_1 = H(m)$
$h_{i+1} = H(f(h_i,m,i))$


Concatenation might be one possibility for $f$, but it could be problematic in Merkle-Damgard constructions. You could also use a hash function for $f$, but that wouldn't adress this problem. Alternatively, you could use an MAC instead, where you use the hash of the previous round and $i$  to derive the key, and you can choose from the various MAC algorithms. Alternatively, you could also use a block cipher directly as $f$, just like the MAC algorithms (well, some MACs are based on block ciphers). But you will have to keep in mind, that $m$ itself might be a lot longer. A more general way might be the assumption of a PRF.

On a similar note: Alternatively, you could use a  CSPRNG based on a hash function, seed it with the message, and then iterate just "far enough", that it matches your wanted number of iterations, and use that as output.

For your consideration of 128 bit, I would say CMAC/OMAC with AES could be used, e.g.$f:= CMAC_{h_i}(m||i)$