Design flaws when designing a MAC-function

Question

Suppose we want to build a very basic hash function like this:

$$c_i = h(c_{i-1},x_i) = c_{i-1}\oplus x_i \quad\quad mit \;\; i\geq1, c_0 = \operatorname{IV}$$

Now suppose we'd use this hash-function to construct a custom-MAC-function in this fashion:

$$\operatorname{MAC}_k(c) \equiv c_n +k_1 + k_2 + \cdots + k_{16} \bmod 256$$

The function uses two operations, namely $\left(\left[\oplus, 2^{8}\right] \text { and }\left[+, 2^{8}\right]\right)$ and we use a 128-bit key, where $k_1 , k_2 $ etc. represent the corresponding bytes of said key

Needless to say, this MAC-function has some horrible design flaws and I've spent some thoughts on what these are specifically

My question is which design flaws, apart from the following, could be pointed out. I am particularly interested in which design flaws this function has, which also apply to other cryptographic functions, such as block-ciphers and hash-functions In other words: Which properties do we generally aim for when designing cryptographic functions, and which of these does our custom MAC-function violate?

These are my points:

• $+$ Addition does not actually increase the key, because of mod 256
• very small modulo
• low collision resistance, for example by flipping two bits in any $x_i$ we get the same MAC.

Question: Collision resistance is usually a property of hash-functions, would that also be a proper term to describe block-ciphers? E. g. Is this a proper statement: "AES was designed to have low collision resistance"

• No diffusion effect: Making small changes in the plaintext or key result in roughly the same output

Have I missed something or misunderstand something?

Answer 1

Collision resistance is usually a property of hash-functions, would that also be a proper term to describe block-ciphers?

Well, kind of.

The message space of a hash function is huge. It contains about 2 ^ 2 ^ 129 separate messages for SHA-512, for instance. So it will have collisions as the output size is limited to 512 bits.

On the other hand a keyed block cipher is a permutation, a mapping from all input elements to a specific output element each. As all the input is mapped to a unique value in the output, there cannot be any collisions on the block cipher itself.

You haven't specified any method of using the block cipher for messages with a different size than that of the block size. If the block cipher is used in a specific way then you may well have a possible collision and therefore collision resistance when those are hard to find. Many hash functions are build on top of block ciphers after all, but it depends on the block cipher specifics and the way that it is used if that's secure.