# Tag Info

If I understand you correctly, you are using the Simon key expansion process, so that the input to your block is the 256 bit Simon key, and the output is the 256 bit last round key (and you're ignoring the Simon encryption process entirely). If so, three nits: I believe that you can find preimages for your hash function in $O(2^{64})$ compression function ...