I'm studying for a cryto exam and have run across this question which has stumped me.
What is wrong in the following algorithm for computing a hash function?
- Take a message $M$,
- generate a random private RSA key $K$.
- Encrypt $M$ with $K$ and
- take the first 240 bits of the result as a hash of $M$