SHACAL-2 vs. AES as underlying block cipher for Secure Hash (aka SHA-256) The hashing scheme SHA-256 (for instance) is based on Merkle-Damgård construction with the underlying compression function based on the block cipher SHACAL-2 configured in Davies Meyer mode. SHACAL-2 has 80 rounds, per 512 bit block of data (which is inserted in the key input of the block cipher). As an alternative, one could use AES with 256 bit key (so the hashed data should be divided to 256 bit blocks, inserted as a key) and using Davies Meyer principle in the same way. Seemingly, this would be much more efficient, because AES-256 requires 14 rounds, or total 28 rounds in order to process 512 bit of data, while theSHACAL-2 requires 80 rounds. Is there any standard that does this?
Using AES as a Davies Meyer compression function is a bad idea:

It has a block size of 128 bits, which limits its collision resistance to 64 bits, which is rather weak.
This limitation could be overcome by using Rijndael with a 256 bit block size, but then you'd need to use a higher number of rounds.

AES has been designed to work with randomly chosen keys, not with attacker chosen keys.
AES suffers from related key attacks. While I'm not aware of published a way to exploit this to find collisions, it certainly undermines my confidence is such a construction. You could increase the number of rounds to compensate for this, but that'd decrease performance.
See Are AES-256's related-key weaknesses exploitable if it is used to build a hash?

Block ciphers designed for use in hash functions have very cheap key setups. While AES isn't as expensive as Blowfish, changing the key still has a noticeable performance impact.


Fewer rounds doesn't necessarily mean more efficient:
Comparing the absolute number of rounds of different cryptographic primitives is meaningless. You can design a primitive to have many cheap and simple rounds or fewer more expensive and more complex rounds, resulting in similar performance.
See Why does SHA-1 have 80 rounds?
AES isn't that fast on a CPU without special instructions, like AES-NI, probably even slower than SHA-2 on some CPUs.