Tag Info

0

Using AES as a Davies Meyer compression function is a bad idea: It has a block size of 128 bits, which limits its collision resistance to 64 bits, which is rather weak. This limitation could be overcome by using Rijndael with a 256 bit block size, but then you'd need to use a higher number of rounds. AES has been designed to work with randomly chosen ...

4

A compression function takes two fixed size inputs: a chaining value and a message and returns a fixed size value. So it's essentially a hash function with fixed input size. Merkle-Damgård is a domain extender, which turns that compression function into a hash which supports arbitrarily long messages. MD uses the output of the compression of one block as ...

2

You will need a quadratic non-residue in order to decompress the points, and there is no known deterministic algorithm that will provably find one efficiently. Also, if you allow both sign bits for $\: y=0 \:$ or the point-at-infinity, then you will lose non-malleability and strong unforgeability.

Top 50 recent answers are included