**Short info: AES**

AES is a family of permutations like any block cipher. A block cipher has a short block size like AES has 128-bit. In order to operate you need a mode of operation.

**Short info: Hash functions** 

Hash functions are one-way, deterministic, and in some sense have an unpredictable output (until one calculates). They are mainly built for collision resistance and pre-image resistance (first and second).

> A. The key of the AES is never exposed. (Without knowing the key, I believe there is no possibility of decryption and hence one-way function as a hash)
>
>B. For some applications, the input size is always fixed.
>In this case, if someone uses AES encryption as the purpose of hash, do any possible problems exist?

- The output size is the first problem. For example; for an integrity check, a good 512-bit hash function is enough. With encryption, there is no integrity without a proper mode of operation and those are not part of encryption like CBC-MAC, HMAC, KMAC, NMAC, GCM, Poly1305, etc.

- One needs the key to verify, on the other hand, hashing is free. Consider you build a password from a hash function than without the key you can verify the password. With encrypted passwords, one needs the key to verify.

- You want to sign documents and hashing before signing is part of the security since the first true Rabin-signature scheme. How do you consider reducing the size to 256 or 512-bit to sign the document with encryption?

- File comparison; one can simply exchange the hash of the files to check the equality; right just 512-bits. Do you want to send the 5GB file encrypted then compared it?

> There is a method to make a hash function based on the block cipher.

This is Merkle-Damgard (MD) based construction that uses block cipher on [Devies-Mayer][1] method to build a compression function. Unfortunately, there are two major problems for AES to be used in MD

 - AES has related-key attacks that enable building collision if used in MD 
 - The block size is 128 and this makes the output of the hash function 128-bit. Not secure enough to find the collisions!

  [1]: https://en.wikipedia.org/wiki/One-way_compression_function#Davies%E2%80%93Meyer