How secure would a hash function be which appends an extra block of 16 zeroed out bytes to the end of the message and then AES-encrypts it with a well-known password (say the first 128 bits of pi) using cipher-block-chaining and then XORs all the encrypted blocks together?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
Not at all secure; generating preimages would be trivial. Here's a demonstration with a three-block message:
Here is your suggested method (limited to three block messages):
$E_0 = Encrypt( IV \oplus P_0 )$
$E_1 = Encrypt( E_0 \oplus P_1 )$
$E_2 = Encrypt( E_1 \oplus P_2 )$
$E_3 = Encrypt( E_2 \oplus 0 )$
$Hash = E_0 \oplus E_1 \oplus E_2 \oplus E_3$
(with the key for Encrypt and the IV fixed).
Here's how you could find a message $(P_0, P_1, P_2)$ that hashes to a preselected value $Hash$:
You're done: $(P_0, P_1, P_2)$ hashes to preselected value; it's easy to see that hashing this value will cause the internal $E_0, E_1, E_2, E_3$ values that we have selected, and that exclusive-oring them will produce the preselected hash.
In addition, you would want to use at least 256 bits of "state" for an iterated 128 bit hash function due to the existence of generic attacks to produce state collusions. You might want to google for "wide pipe construction" or "random sponge function".