Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
At a first look, one could use the elliptic curve discrete logarithm problem to grant for the onewayness of $H(x)=x*G$ (where $G$ is the generator point of the cyclic subgroup).
Additionally, $H(x)$ is homomorphic since $H(x+y)=H(x)+H(y)$, which could prove to be a useful property for a hash function in some applications.
What are some of the disadvantages or vulnerabilities that makes such a hashing scheme not popular in practice?
A secure hash function based on the discrete log problem is $H(x\|y)=x\cdot G+y\cdot P$, where $P$ is a random point for which the discrete log is not known and "$\|$" denotes concatenation; this was shown by Damgård. This can be proven collision resistant under the discrete log assumption (if you can find a collision then this can be used to find the discrete log of $P$). Note that in order for it to be of interest, the output has to be shorter than the input. However, this is easily achieved for most curves by using point compression. Once you have this function, you can get a general collision-resistant hash function by applying the Merkle-Damgård transform.
Of course, this would be extremely inefficient, but it is a collision resistant hash function from the discrete log problem.
The paper presenting this is Collision Free Hash Functions and Public Key Signature Schemes by Ivan Damgård. It is also described in Section 8.4.2 of the Katz-Lindell textbook (second edition).
