We change the AES block cipher encryption:
- we delete the key schedule algorithm
- the user now provides a string of 1408 bits
- we divide the string to 11 sub keys, and use them directly in the encryption part of AES as the round keys.
We call the resulting function $AES' : \mathbb Z_2^{1408} \times \mathbb Z_2^{128} \to \mathbb Z_2^{128}$.
Then we use this function $AES'$ as cryptographic compression function in the following way:
Given text $M$, we divide it to blocks $M_1, \dots M_n$ of size 1408 bits each. Then define $g_i \in \mathbb Z_2^{128}$ as
- $g_0=0$
- $g_i = AES'(M_i,g_{i-1})\quad$ (Each $M_i$ is used as the round keys in one AES encryption.)
Then the hash function $h : \mathbb Z_2^{n·1408} \to \mathbb Z_2^{128}$ is defined as follows : $h(M)=g_n$
Is $h$ a one way function? If not, how could an attack reveal $M$, given $h(M)$?
(I don't want you to solve, I just want some hints to solve this problem.)