Is it basically safe and correct to use the Matyas–Meyer–Oseas construction to turn a fast block cipher like AES into a really fast single block hash function?
By single block hash function I mean one that hashes, say, 128 bits of input and produces 128 bits of output. I don't need variable or larger message sizes and if I did I'd use SHA-2, SHA-3, etc., but those are a lot slower for really short fixed length messages. Benchmarks show that this AES construction is more than 10X as fast for hashing single block length messages on a machine with AES-NI CPU extensions.
If I'm understanding Matyas–Meyer–Oseas, the hash function would consist of AES initialized with a static predefined key and then used to encrypt a single block of input ("ECB" mode). The result of encryption would then be XORed with the original block to produce an output hash. Further initialization of the cipher with subsequent blocks wouldn't be done since you're only hashing messages whose size is equal to the block size.
If you're curious the application would be Winternitz one-time signatures. Winternitz signatures involve a whole lot of iterative hashing of single block size messages. Preimage resistance is important so a good hash function is needed but for compact signatures you want to increase the height of the "columns" in the signature.