# Is $f_N$ in this hash function is Matyas-Meyer-Oseas scheme?

I propose a hash function as following:

H is an Merkle-Damgard hash function with a compression function $$f: \{0,1\}^{3n} \to \{0, 1\}^{2n}$$. Output function $$f_N: \{0,1\}^{3n} \to \{0, 1\}^n$$. M is input message and M* is padded message as follow rule: message M divided into n-bit message blocks $$m_i$$, $$1 ≤ i ≤ t$$ and t = $$\lceil|M|\rceil/n - 1$$, $$m_t+1$$ is last block (remaining part) of M is padded with bit ‘1’ and ‘0’-bits to get full n-bit block and $$m_t+2$$ represent message’s bit length in binary of M. $$M^* = Pad(M) = m_1 m_2...m_{t+1} m_{t+2}, m_i \in {0, 1}^n$$, with $$1 \leq i \leq t+2$$;

Hash computing process is handed according to follow procedure:

$$\begin{multline} \shoveleft h_0 = IV_1\\ \shoveleft g_0 = IV_2\\ \shoveleft C_{T_i} = 0 \end{multline}$$

$$\begin{multline} \shoveleft \textbf{for } i = 1 \textbf{ to } t+1 \textbf{ do }\\ \shoveleft \quad\quad (h_i, g_i) = f(h_{i-1} \oplus C{{T_i}}, g_{i-1}, m_i)\\ \shoveleft C_{T_i} = C{T_{i-1}} + 512\\ \shoveleft (h_{t+1}, g_{t+1}) = f(h_t \oplus C_{T_{t+1}}, g_t, m_{t+1}) \\ \shoveleft H(x) = left_s f_N(h_{t+1}, g_{t+1}, m_{t+2})) \end{multline}$$

$$H(x)$$ is the hash result.

left is get $$s$$ bits on left of $$f_N$$

My $$f_N$$ is:

$$f_N: h = E(h_{t+1}\mathbin\|g_{t+1},m_i ) \oplus m_i$$ $$E(K,m)$$ is a block cipher with $$2n$$-bit keylength, block size is $$n$$-bit.

My questions:

• Is $$f_N$$ in this hash function Matyas-Meyer-Oseas scheme?
• And may I use Theorem 6 and 15 in Stam's result in "Stam, Martijn. "Blockcipher-based hashing revisited. for this compress function?
• The $f$ is Matyas-Meyer-Oseas not $f_N$. $f_N$ is MD. Jul 2, 2020 at 16:55
• kelalaka - You means if I write $(h_i, g_i) = E(h_{i-1}||g_{i-1}, m_i)$, it will be MMO (PGV1) scheme? Jul 3, 2020 at 3:50