Is a new block cipher harder to design than a new hash?

Question

I realise that cipher and hash primitives are somewhat different. But they share common requirements like attack resistance amongst others. And I realise that attacks /vulnerabilities are different for each. However in addition to resisting attacks, a cipher has to be reversible given the correct key. And it has to be very not reversible given a slightly incorrect key. A hash does not, simply needing something like what the RadioGatún team called a secure mangling function.

Does this mean that a new secure block cipher is more difficult to develop than a new secure hash? Or are they just too applely and orangey for objective comparision?

---

PS. I'm aware of Feistel networks and stream ciphers. I'm referring to the block primitives themselves like DES & AES v. SHAx & Whirlpool and whatever else is in the pipeline.

Answer 1

There are standard constructions for block ciphers and hashes that can be instantiated with a given "mangling function", where the "mangling function" is a fixed permutation such as keccak-f, or for another example Rijndael without the addRoundKey layer.

There are really two different things you might design: A new construction that uses a permutation, or a new permutation for instantiating a given construction^*.

Instantiating a known construction with a new permutation

If you want to develop a new permutation and instantiate a key-alternating block cipher or sponge construction for hashing, then they are more or less challenges of equivalent difficulty. There are some differences.

One of those differences has to do with how you calculate how many rounds the resultant design will require to be secure. A hash function does not use a secret key, and so an adversary has an easier time crafting inputs that will target the weak points of the design. So an unkeyed hash function will tend to require more rounds than a block cipher to achieve the target security goal.

A permutation designed for a hash function may also be larger than one designed for a block cipher. This may seem like a trivial detail, but with vectorized designs MOV instructions into vector registers are expensive, and there usually are no vector rotate instructions. Using SIMD (single-instruction-multiple-data) efficiently is more challenging than not using it at all, but you can't make a big permutation that is fast without it.

A block cipher tends to incorporate a key schedule of some kind, which is a requirement that will not necessarily be present when designing a hash function. If you are using a block cipher in a Merkle–Damgård construction then the key schedule will be relevant to the security - this is where the related-key attack model is relevant.

It may be slightly easier to design a permutation for a block cipher than a hash function if you can get away with a 128-bit block size, due to not having to muck about with SIMD.

Designing new constructions

The other game to play is: Suppose you are given a permutation such as keccak-f. How can you create a block cipher with it? How can you create a hash function with it?

This game is arguably more open-ended and challenging than the previous one. If you want to find a construction that is not simply a variation on a pre-existing construction, you may have a lot of thinking to do.

In this case you can't really answer whether coming up with a new block cipher or hash construction would be more challenging than the other - how can you rate the difficulty of coming up with novel ideas that you don't know of yet? Who's to say whether Merkle–Damgård style hash functions were harder to come up with than Feistel networks, especially when you assume that you don't yet know of the existence of either type of construction?

^* It doesn't have to be a permutation (which is invertible), but it helps to keep the answer simple and on-point to only consider permutations.