I am trying to understand if it possible to use DLP to build a keyed one-way function with the following properties:
- $H_a(H_b(M)) = H_c(M)$, where $a$ and $b$ are the keys, and $c=a*b$
- The output of the function is relatively small - e.g. 256 bits
The function itself could be $h_a=M^a$ mod $p$, where $p$ is a 256-bit prime. However, I'm not sure how secure this would be given that the prime is pretty small. Specifically, I want to understand if the following would hold:
- Given $h_a$ and $p$, it would be impractical to compute $M$
- Given $h_a$, $M$, $c$, and $p$, it would be impractical to compute $a$
The messages I need to process are relatively small (256 - 512 bits), but can be padded if that would increase security.