# Using variable length CBC-MAC, can some block cipher with a fixed k be used as a cryptographic hash function?

If a variable length CBC-MAC is used with a block cipher (a.k.a. pseudorandom permutation), does there exist a block cipher such that implementation of this CBC-MAC may be used as a cryptographic hash function, provided that k is fixed?

• block cipher indicates that this transformation is fixed length... I'll let you figure out rest. – axapaxa Jul 14 '17 at 1:40
• The question has been edited to comply with a variable length input – gibarsin Jul 14 '17 at 1:51

CBC-MAC on a two-block message $(M_0, M_1)$ (after padding) is defined as $E_k( M_1 \oplus E_k( M_0 ))$. To find a preimage for a value $S$, you select $M_1$ with a valid padding pattern (because of the padding, we cannot select this block arbitrarily), and compute $M_0 = D_k(M_1 \oplus D_k(S))$; it is easy to see that the padding message $(M_0, M_1)$ hashes to the value $S$.
And, even if you cannot easily compute $D_k$, it is still easy to find second preimages...
• @gibarsin: if $E_k$ is the application of the block cipher (in the encrypt direction; that is, if $B$ is the input block, then $E_k(B)$ is the value of the output block), then $E_k( M_1 \oplus E_k( M_0 ))$ is what is computed when doing CBC-MAC on a 2 block message (ignoring padding), and $D_k$ is the block cipher in the decrypt direction. – poncho Jul 14 '17 at 13:24