# Can NORX be used as a general purpose hash function?

In general terms, NORX works combining a cryptographic hash function and an stream cipher. At the end of an encryption operation you end with a ciphered message plus its authenticated hash. If you call AEADEnc() whith a zero length secret and postfix message, you basically get a hash function for each $(key, nonce)$ pair.

My question is, given a fixed and public $(key, nonce)$ pair, can NORX AEADEnc() work as a secure cryptographic hash function?

• the capacity is too low, and would probably need double the round count – Richie Frame Jul 5 '18 at 4:22
• @RichieFrame There is a 6 rounds variant that is still fast enough. This is not a problem. What to do with capacity? Are there any references about it? – user3368561 Jul 5 '18 at 8:43
• by double I mean 12 = double of 6, norx is a sponge function, so it has a capacity that relates to its security, and norx64 has a capacity of 256-bits, which is appropriate for a 128-bit hash function – Richie Frame Jul 5 '18 at 10:02
• @RichieFrame By 128-bits hash function you mean a 128-bits of security and 256-bit digest size (birthday paradox) or a 64-bits of security and 128-bits digest size? – user3368561 Jul 5 '18 at 10:51
• 128-bits of security, but you would need to output 256-bits of tag – Richie Frame Jul 5 '18 at 20:20