k2 be two arbitrary fixed keys (nothing-up-my-sleeve values like "foo" and "bar") and
E_k2 be the corresponding encryption functions of a block cipher.
x is a single input value (same value is fed to both
Define a hash as follows:
H(x) = E_k1(x) xor E_k2(x)
This hash is meant to be used exclusively for proof-of-work purposes. The input size is assumed to exactly match the block size. There is no significant issue with the risk non-trivial collisions. The construction was intentionally designed to include only encryption operations, not key-scheduling (for optimization reasons). This makes it different than common constructions like Davies–Meyer, Matyas–Meyer–Oseas or Miyaguchi–Preneel.
Black, Cochran and Shrimpton have shown that it is impossible to construct a one-way compression function that makes only one call to a block cipher with a fixed key.
This one uses two fixed keys, so it leaves the option it is good enough.
The underlying cipher is intended to be AES-128 or AES-256.
The question is: do you know of papers that have tried to analyze this type of construction? Can you give some of your own insights?
Edit: The intention was to define a hash. I misunderstood the idea of "compression function". I have changed the title now.