Secure Hash Function based on AES How secure would a hash function be which appends an extra block of 16 zeroed out bytes to the end of the message and then AES-encrypts it with a well-known password (say the first 128 bits of pi) using cipher-block-chaining and then XORs all the encrypted blocks together?
Not at all secure; generating preimages would be trivial.  Here's a demonstration with a three-block message:

Here is your suggested method (limited to three block messages):

$E_0 = Encrypt( IV \oplus P_0 )$

$E_1 = Encrypt( E_0 \oplus P_1 )$

$E_2 = Encrypt( E_1 \oplus P_2 )$

$E_3 = Encrypt( E_2 \oplus 0 )$

$Hash = E_0 \oplus E_1 \oplus E_2 \oplus E_3$

(with the key for Encrypt and the IV fixed).

Here's how you could find a message $(P_0, P_1, P_2)$ that hashes to a preselected value $Hash$:


Select an arbitrary value for $P_2$ (which may include the trailing padding for the last block)
Select an arbitrary value for $E_2$.
Compute $E_3 = Encrypt( E_2 \oplus 0 )$, $E_1 = Decrypt(E_2) \oplus P_2$ and $E_0 = Hash \oplus E_1 \oplus E_2 \oplus E_3$
Compute $P_0 = IV \oplus Decrypt( E_0 )$ and $P_1 = Decrypt(E_1) \oplus E_0$


You're done: $(P_0, P_1, P_2)$ hashes to preselected value; it's easy to see that hashing this value will cause the internal $E_0, E_1, E_2, E_3$ values that we have selected, and that exclusive-oring them will produce the preselected hash.