# Why is the compression function in Miyaguchi-Preneel scheme secure? [duplicate]

I was reading about the Miyaguchi-Preneel scheme and had difficulty in understanding why the compression function, $h(H,m)=E(H, H \oplus M) \oplus M \oplus H$ can be called secure. The only resource I could find about this was Black-Box Analysis of the Block-Cipher-Based Hash-Function Constructions from PGV.

Again, I am having trouble with the explanation provided there. So, if someone could please clear my doubt, that would be great, thanks!

• Did you read this answer? It points to that paper so perhaps you did? – otus Mar 3 '16 at 7:45
• Thanks, I did. I looked at this first, before posting my question. The one who answered there has only referred to that paper and explained what an ideal cipher is. I already know the latter, it is the explanation in the paper/the answer to my question, that I want help with. – Tom Corless Mar 3 '16 at 19:23
• The formula you have given seems to be incorrect to me. – aventurin Mar 3 '16 at 21:51