DLP-based keyed one-way function
An adversary who can compute discrete logs modulo $p$, given oracle access to $H_a$ for unknown $a$, can compute $\log_2 H_a(2) \equiv \log_2 2^a \equiv a \pmod p$ with a single query to the oracle.

After that, given $h = H_a(M)$ for unknown $M$, they can compute $$h^{a^{-1}} \equiv (M^a)^{a^{-1}} \equiv M^{a\cdot a^{-1}} \equiv M \pmod p,$$ where $a^{-1}$ is the inverse of $a$ modulo $\phi(p) = p - 1$.

If $p$ is 256 bits, adversaries can compute discrete logs modulo $p$ today.  You need $p \gg 1024$ to be safe, among other criteria.

It might be helpful to go into more detail about why you need these properties, and what you are trying to achieve more generally.