I should be able to find a collision for a vulnerable hash function which uses AES ECB given a prefix, but I am unable to find a reasonable solution (besides brute-force attack).
The hash function is really simple, it uses AES ECB with a known IV with all 1's. The result is then bitwise XORed and used as key for next ciphering block (if any). More formally:
$$S_0=1^{128}, S_i=\operatorname{AES}_{S_{i-1}\parallel S_{i-1}}(M_i)\oplus S_{i-1}$$ with $M_i$ being the current 128-bit message block, AES using a 256-bit key and the $S_i$ of the last message block being the output.
I have been reading about the Chosen-prefix collision attack, but my case is slightly different (and even easier) because what I search are two words $w_1$ and $w_2$ that, given a known prefix $p$, $\operatorname{hash}(p \| m_1) = \operatorname{hash}(p \| m_2)$ with $w_1 = p \| m_1$ and $w_2 = p \| m_2$ and $w_1 \neq w_2.$