Is the hash function $h(x\|y) = AES_x( y)$ collision resistant? If $x$ and $y$ are both 128-bit strings would the function $h(x||y) = AES_x(y)$, where $x\|y$ means concatenation, be considered collision resistant ?


Is there an easy way to find $(x_1, y_1)$ and $(x_2, y_2)$ such that $h(x_1\|y_1) = h(x_2\|y_2)$ ?


I couldn't think of a way but since the hash function is un-keyed something tells me that there is a way to manipulate the key/string pairs?
It isn't even second-preimage resistant. Hint:


   $y = \mathrm{AES}^{-1}_{x}(\mathrm{AES}_{x}(y))$


For any 128-bit string $x_1$, $x_2$ and $y_1$,


   $h(x_1||y_1) = \mathrm{AES}_{x_1}(y_1) = \mathrm{AES}_{x_2}\left(\mathrm{AES}^{-1}_{x_2}(\mathrm{AES}_{x_1}(y_1))\right) = h\left(x_2 || \mathrm{AES}^{-1}_{x_2}(\mathrm{AES}_{x_1}(y_1))\right)$


Follow-up question: is it preimage-resistant?


   $h(x||y) = \mathrm{AES}_{x}(y)$ so $y = \mathrm{AES}^{-1}_{x}(h(x||y))$. For any hash value $H$ and any 128-bit string $x$, it's trivial to calculate a preimage that begins with $x$.