There are standard constructions for block ciphers and hashes that can be instantiated with a given "mangling function", where the "mangling function" is a fixed permutation such as [keccak-f][1], or for another example [Rijndael][2] without the addRoundKey layer. There are really two different things you might design: A new construction that uses a permutation, or a new permutation for instantiating a given construction<sup>*</sup>. Instantiating a known construction with a new permutation ---- If you want to develop a new permutation and instantiate a [key-alternating block cipher][3] or [sponge construction][4] for hashing, then they are more or less challenges of equivalent difficulty. There are some differences. One of those differences has to do with how you calculate how many rounds the resultant design will require to be secure. A hash function does not use a secret key, and so an adversary has an easier time crafting inputs that will target the weak points of the design. So an unkeyed hash function will tend to require more rounds than a block cipher to achieve the target security goal. A permutation designed for a hash function may also be larger than one designed for a block cipher. This may seem like a trivial detail, but with vectorized designs MOV instructions into vector registers are expensive, and there usually are no vector rotate instructions. Using SIMD efficiently is more challenging than not using it at all, but you can't make a big permutation that is fast without it. A block cipher tends to incorporate a key schedule of some kind, which is a requirement that will not necessarily be present when designing a hash function. If you are using a block cipher in a Merkle–Damgård construction then the key schedule will be relevant to the security - this is where the [related-key attack model][5] is relevant. It may be slightly easier to design a permutation for a block cipher than a hash function if you can get away with a 128-bit block size, due to not having to muck about with SIMD. Designing new constructions --- The other game to play is: Suppose you are given a permutation such as keccak-f. How can you create a block cipher with it? How can you create a hash function with it? This game is arguably more open-ended and challenging than the previous one. If you want to find a construction that is not simply a variation on a pre-existing construction, you may have a lot of thinking to do. In this case you can't really answer whether coming up with a new block cipher or hash construction would be more challenging than the other - how can you rate the difficulty of coming up with novel ideas that you don't know of yet? Who's to say whether [Merkle–Damgård][6] style hash functions were harder to come up with than [Feistel networks][7], especially when you assume that you don't yet know of the existence of either type of construction? <sup>*</sup> It doesn't *have* to be a permutation (which is invertible), but it helps to keep the answer simple and on-point to only consider permutations. [1]: https://eprint.iacr.org/2011/023.pdf [2]: https://autonome-antifa.org/IMG/pdf/Rijndael.pdf [3]: https://cs.nyu.edu/~dodis/ps/EM-indiff.pdf [4]: https://en.wikipedia.org/wiki/Sponge_function [5]: https://crypto.stackexchange.com/questions/1549/related-key-attacks-on-aes [6]: https://en.wikipedia.org/wiki/Merkle%E2%80%93Damg%C3%A5rd_construction [7]: https://en.wikipedia.org/wiki/Feistel_cipher