Let k1
, k2
be two arbitrary fixed keys (nothing-up-my-sleeve values like "foo" and "bar") and E_k1
and E_k2
be the corresponding encryption functions of a block cipher. x
is a single input value (same value is fed to both E_k1
and E_k2
).
Define a hash as follows:
H(x) = E_k1(x) xor E_k2(x)
This hash is meant to be used exclusively for proof-of-work purposes. The input size is assumed to exactly match the block size. There is no significant issue with the risk non-trivial collisions. The construction was intentionally designed to include only encryption operations, not key-scheduling (for optimization reasons). This makes it different than common constructions like Davies–Meyer, Matyas–Meyer–Oseas or Miyaguchi–Preneel.
Wikipedia says:
Black, Cochran and Shrimpton have shown that it is impossible to construct a one-way compression function that makes only one call to a block cipher with a fixed key.
This one uses two fixed keys, so it leaves the option it is good enough.
The underlying cipher is intended to be AES-128 or AES-256.
The question is: do you know of papers that have tried to analyze this type of construction? Can you give some of your own insights?
Edit: The intention was to define a hash. I misunderstood the idea of "compression function". I have changed the title now.
10
,100
and1000
inputs can all be considered $ \ngtr 2^{128} -1$, yet they're different but the same if not padded. BTW: AES is always a 128 bit block... $\endgroup$ – Paul Uszak Feb 10 at 16:23x
s meant to be the same? $\endgroup$ – Paul Uszak Feb 10 at 16:49