I would like to set a trusted browser cookie that allows a user to bypass 2-factor authentication by email if they've successfully logged in on a given machine before. The idea would be to make it easier to log in on trusted machines for convenience.
My idea is to create a keyed hash of the email address like so:
<?php
define('HASH_KEY', '5sqAgsdwqNWEHpEz3pAFVQUb2Mr7acHtuezKSVykX52bCKeSJmo236HtE0U9Noj2);
$hash = hash_hmac('sha256', $email, HASH_KEY);
// E.g. '9fa0d85b36919dc87ee01171edf6bdc302ffbc78e0c7f1738d295e76e442ccd4'
And then truncate it to say 16 digits:
$hash = substr($hash, 0, 16);
// E.g. '9fa0d85b36919dc87'
?>
The plan would then be to store the truncated hash in a cookie as a trusted browser token. Then, when the user attempts to log in later, the complete hash is regenerated using the same HASH_KEY and the email address supplied during login, then the first 16 digits of the new hash are compared with the cookie. If they match, 2fa is bypassed, otherwise we require it.
So my question is, does this truncation process make the hash more secure as it's incomplete? Or am I just as well using the full hash as there's no difference?