Is XORing a SHA256 better than truncating it? Let say I want to truncate SHA256 to 128 bits. What would be the best way to minimize a probability of a collision and improve collision resistance?


Taking the last 16 bytes
Taking the first 16 bytes
XORing the first 16 bytes and the last 16 bytes together


And should I assume that the same logic will apply for other hash functions from the SHA-2 set (like SHA516) as well as other hash functions in general, for example, SHA-1 or MD5?
As pointed out in an answer to an older question, SHA-224 is more or less just using the first bits of the output of SHA-256. That is just about the most official construction anyone can find.

The XOR approach is however not entirely unprecedented, for example Linux uses that approach on SHA1 in order to generate random bits.

There is real security to be gained by not using either approach, but instead use a cryptographic hash to reduce the 256 bits down to 128 bits. This would provide protection against length extension attacks.

Also worth noting is that on 64 bit architectures SHA-384 and SHA-512 are both faster than SHA-256. So you may in fact get a faster and more secure result by computing SHA-512 and then reducing that output down to 128 bits using another hash.

I do however not know which hash could be recommended for reducing the output from 256/512 bits to 128 bits.