Suppose we want to build a very basic hash function like this:
$$c_i = h(c_{i-1},x_i) = c_{i-1}\oplus x_i \quad\quad mit \;\; i\geq1, c_0 = \operatorname{IV}$$
Now suppose we'd use this hash-function to construct a custom-MAC-function in this fashion:
$$\operatorname{MAC}_k(c) \equiv c_n +k_1 + k_2 + \cdots + k_{16} \bmod 256$$
The function uses two operations, namely $\left(\left[\oplus, 2^{8}\right] \text { and }\left[+, 2^{8}\right]\right)$ and we use a 128-bit key, where $k_1 , k_2 $ etc. represent the corresponding bytes of said key
Needless to say, this MAC-function has some horrible design flaws and I've spent some thoughts on what these are specifically
My question is which design flaws, apart from the following, could be pointed out. I am particularly interested in which design flaws this function has, which also apply to other cryptographic functions, such as block-ciphers and hash-functions In other words: Which properties do we generally aim for when designing cryptographic functions, and which of these does our custom MAC-function violate?
These are my points:
- $+$ Addition does not actually increase the key, because of mod 256
- very small modulo
- low collision resistance, for example by flipping two bits in any $x_i$ we get the same MAC.
Question: Collision resistance is usually a property of hash-functions, would that also be a proper term to describe block-ciphers? E. g. Is this a proper statement: "AES was designed to have low collision resistance"
- No diffusion effect: Making small changes in the plaintext or key result in roughly the same output
Have I missed something or misunderstand something?