Discrete logarithm over prime modulo: small input, large exponent, larger prime I am considering using modular exponentiation as a one-way hash function. More specifically, here is the scenario.

1) Input ($m$): the input messages are small (16-bit)

2) Exponent ($e$): the exponent is a 160-bit integer, chosen only once, and randomly; the exponent is not public

3) Prime ($p$): a 2048 bit safe prime, chosen only once and is public

The hash of the message is then computed as: $h=m^e$ mod $p$.

My question is whether there exists efficient algorithms to compute the exponent $e$ given a certain $h$, especially since there are only $2^{16}$ possibilities for $m$?
Since attacker does not know $m$, he can't directly apply discrete logarithm methods. On the other hand, small message space allows to run discrete log algorithm on each possible $m$.

There are subexponential algorithms for dlog, but I am not sure if they are directly applicable here. But the general BSGS algorithm will find $e$ in $sqrt(e)$ operations, so for each $m$ candidate we need $~2^{80}$ operations to find some possible $e$ (total $~2^96$ complexity). Notably, most of the wrong candidated for $m$ will not yield any $e$ so this can also be used to "unhash" your "hash". Though complexity is quite high, there are high chances that more effective discrete logarithm can be applied.

Another note: assuming you use odd $e$, this "hash" leaks some information about the message: Legendre symbol (e.g. if the message is quadratic residue mod p or not).

PS: It's not completely clear how you are going to use it and why your attack model assumes only knowledge of $h$, not $m$ (since even then finding $e$ is hard). But this confuses as it may seem that you want also to hide information about $m$, which is really a bad idea here.