A method of hashing, by a processor, a message M using a block cipher, where E(K;D) means encryption of a block D with key K using a block cipher E, comprising: - splitting the message Minto n k -bit blocks M i (140, 141, 142, 143) with i = 0,..., n - 1; - processing the message M iteratively using an internal state S = ( S 0,..., S N -1) of s = N · b bits, which is initialized in the first round with S t = E(0; t) for t = 0,..., N -1; - combining, in round r = 0,1,..., ⌈ n N ⌉ + N − 2, the state S with the blocks M i (140, 141, 142, 143) to a new state S'; - producing N block cipher inputs by XORing message indices i,... i + N - 1 respectively with state values S 0,... S N-1 (100, 101), wherein N is an integer greater than 1; - producing N block cipher keys by XORing N different blocks of message M and at least one of state values S 0,... S N-1 (100, 101) for each of the N block cipher keys; - encrypting the N block cipher inputs using the respective N block cipher keys to produce N block cipher outputs; - combining the N block cipher outputs with N block cipher inputs to produce N block cipher combined outputs T t, for t = 0,..., N - 1; - calculating Y 0 = T 0; - calculating Y t = Y t -1 ⊕ T t, for t = 1,..., N - 1, - calculating S N − 1 ′ = Y N − 1 < < < a, where a is a number of bits to rotate where S 0 ′,..., S N − 1 ′ 190,191 are new state values; - calculating S t ′ = Y t ⊕ S N − 1 ′, for t = 0,..., N - 2; and - outputting the last state S as a hash value h; wherein producing N block cipher keys by XORing N different blocks of message M and at least one of state values S 0,... S N-1 (100, 101) for each of the N block cipher keys, further includes: - calculating X t = ⊕ j = 0 N − 1 M r ⋅ N + t + δ j % N − j ⋅ N ⋅ x δ j mod p x, for t = 0,..., N - 1, where δ ( j) = j · ( j - 1)/2 for j > 0 and 0 for j = 0 and p(x) is a primitive polynomial of degree k where k is the size in bits of the key for the block cipher; - calculating S t = ⊕ j ≠ t S j, zero padded to k bits, for t = 0,..., N - 1,; and - calculating X t ⊕ S t for t = 0,..., N - 1 as the N block cipher keys. - splitting the message Minto n k -bit blocks M i (140, 141, 142, 143) with i = 0,..., n - 1; - processing the message M iteratively using an internal state S = ( S 0,..., S N -1) of s = N · b bits, which is initialized in the first round with S t = E(0; t) for t = 0,..., N -1; - combining, in round r = 0,1,..., ⌈ n N ⌉ + N − 2, the state S with the blocks M i (140, 141, 142, 143) to a new state S'; - producing N block cipher inputs by XORing message indices i,... i + N - 1 respectively with state values S 0,... S N-1 (100, 101), wherein N is an integer greater than 1; - producing N block cipher keys by XORing N different blocks of message M and at least one of state values S 0,... S N-1 (100, 101) for each of the N block cipher keys; - encrypting the N block cipher inputs using the respective N block cipher keys to produce N block cipher outputs; - combining the N block cipher outputs with N block cipher inputs to produce N block cipher combined outputs T t, for t = 0,..., N - 1; - calculating Y 0 = T 0; - calculating Y t = Y t -1 ⊕ T t, for t = 1,..., N - 1, - calculating S N − 1 ′ = Y N − 1 < < < a, where a is a number of bits to rotate where S 0 ′,..., S N − 1 ′ 190,191 are new state values; - calculating S t ′ = Y t ⊕ S N − 1 ′, for t = 0,..., N - 2; and - outputting the last state S as a hash value h; - calculating X t = ⊕ j = 0 N − 1 M r ⋅ N + t + δ j % N − j ⋅ N ⋅ x δ j mod p x, for t = 0,..., N - 1, where δ ( j) = j · ( j - 1)/2 for j > 0 and 0 for j = 0 and p(x) is a primitive polynomial of degree k where k is the size in bits of the key for the block cipher; - calculating S t = ⊕ j ≠ t S j, zero padded to k bits, for t = 0,..., N - 1,; and - calculating X t ⊕ S t for t = 0,..., N - 1 as the N block cipher keys.