# Is this a secure keyed hashing construction?

I need a PRF for use with PBKDF2, however, the only thing I have is the AES block cipher primitive. I'm attempting to derive a keyed hash function from the block cipher. The design is based on the Merkle–Damgård construction. The inputs are $i$ and $k$, for the input data and key, both are a list a bytes. The byte 0xff is appended to $i$, and then subsequent 0x00 bytes are appended until $length(i) \mod 16 = 0$. $i$ is then split into $length(i)/16$ blocks in the array $b$. And then the algorithm continues as follows. $$s_{-1} = k$$ $$s_x = E_{s_{x-1}}(b_x)$$ $$h = s_0 \oplus s_1 \oplus s_2 ... \oplus s_{length(b)-1}$$ $h$ is then returned as the resulting hash. Is this secure enough to use with PBKDF2?

If you want to construct a PRF for arbitrarily-long inputs using AES, then just use CBC-MAC (while prepending the message length in the first block). I don't see any advantage in what you are proposing and therefore don't see any point in trying to analyze something non-standard.

• Alternatively, just use CMAC – poncho Jan 16 '16 at 20:59