Block ciphers used in hash functions built per the Merkle-Damgård structure with a Davies-Meyer compression function (e.g. MD5, SHA-1, and SHA-2) have special requirements:
- They must have a wide block (data input and output): as wide as the hash, thus twice the security (in bits) if collision-resistance is a consideration. For 128-bit security, we thus need a block cipher with a 256-bit block. This disqualifies all three variants of AES, and many earlier block ciphers.
- They must be immune to related-key attacks, which normally are of secondary concern in block ciphers. This disqualifies DES when viewed as a 64-bit key block cipher (and makes it clumsy when viewed as a 56-bit block cipher), and TEA (Microsoft used it anyway in the original Xbox, and got pwned).
- For best efficiency, they need a wide key input (at least twice the block size is typical), and high key agility (low computational effort to change the key). This disqualifies some block ciphers.
The block ciphers used thus tend to be built for the specific use, and designated as the block cipher of their associated hash. An example is SHACAL.