Question

First off: I know that AES is a block cipher and not a hashing function. However, I’m stuck with a micro controller with very little RAM and flash memory, and AES-128 is already implemented on it and used for its intended purpose – encryption.

Unfortunately, I’ll also have to implement a hashing function for file integrity checks on the same micro controller. Given the limited resources, I was wondering if it would be possible to use the existing AES algorithm instead of MD5 for hashing. One possibility to do that would be:

1. Encrypt the first block of the file using a dummy key (like all zeroes for example)
2. Encrypt the next block using the previous encrypted block as the key
3. Continue this way until all data in the file has been processed
4. Use the last encrypted block as the hash

In theory, I think this should work. If there is corrupted data anywhere in the file, it would lead to differences in all subsequent blocks.

Now, the big question is: How well would this method perform in terms of collisions? Or to put it differently: How well would the final “hash” be distributed?

Answer 1

It sounds like you want to use AES-CMAC, an authentication algorithm based in AES.