A method of hashing, by a processor, a message M using a block cipher, where E(K;D) means encryption of a block D with key K using a block cipher E , comprising: - splitting the message Minto n k -bit blocks M i with i = 0, ..., n - 1; - processing the message M iteratively using an internal state S = ( S 0 , ..., S N -1 ) of s = N · b bits, which is initialized in the first round with S t = E(0; t) for t = 0, ..., N -1 ; - combining, in round r = 0,1 , ... , ⌈ n N ⌉ + N − 2 , the state S with the blocks M i to a new state S' ; - producing N block cipher inputs by XORing message indices i, . . . i + N - 1 respectively with state values S 0 , ... S N-1 , wherein N is an integer greater than 1; - producing N block cipher keys by XORing N different blocks of message M and at least one of state values S 0 , ... S N-1 for each of the N block cipher keys; - encrypting the N block cipher inputs using the respective N block cipher keys to produce N block cipher outputs; - combining the N block cipher outputs with N block cipher inputs to produce N block cipher combined outputs T t , for t = 0, ... , N - 1; - calculating Y 0 = T 0 ; - calculating Y t = Y t -1 ⊕ T t , for t = 1, ..., N - 1, - calculating S N − 1 ′ = Y N − 1 < < < a , where a is a number of bits to rotate where S 0 ′ , ... , S N − 1 ′ 190,191 are new state values; - calculating S t ′ = Y t ⊕ S N − 1 ′ , for t = 0,..., N - 2; and - outputting the last state S as a hash value h ; wherein producing N block cipher keys by XORing N different blocks of message M and at least one of state values S 0 , ... S N-1 for each of the N block cipher keys, further includes: - calculating X t = ⊕ j = 0 N − 1 M r ⋅ N + t + δ j % N − j ⋅ N ⋅ x δ j mod p x , for t = 0, ... , N - 1, where δ ( j ) = j · ( j - 1)/2 for j > 0 and 0 for j = 0 and p(x) is a primitive polynomial of degree k where k is the size in bits of the key for the block cipher; - calculating S t = ⊕ j ≠ t S j , zero padded to k bits, for t = 0, ..., N - 1,; and - calculating X t ⊕ S t for t = 0, ..., N - 1 as the N block cipher keys. - splitting the message Minto n k -bit blocks M i with i = 0, ..., n - 1; - processing the message M iteratively using an internal state S = ( S 0 , ..., S N -1 ) of s = N · b bits, which is initialized in the first round with S t = E(0; t) for t = 0, ..., N -1 ; - combining, in round r = 0,1 , ... , ⌈ n N ⌉ + N − 2 , the state S with the blocks M i to a new state S' ; - producing N block cipher inputs by XORing message indices i, . . . i + N - 1 respectively with state values S 0 , ... S N-1 , wherein N is an integer greater than 1; - producing N block cipher keys by XORing N different blocks of message M and at least one of state values S 0 , ... S N-1 for each of the N block cipher keys; - encrypting the N block cipher inputs using the respective N block cipher keys to produce N block cipher outputs; - combining the N block cipher outputs with N block cipher inputs to produce N block cipher combined outputs T t , for t = 0, ... , N - 1; - calculating Y 0 = T 0 ; - calculating Y t = Y t -1 ⊕ T t , for t = 1, ..., N - 1, - calculating S N − 1 ′ = Y N − 1 < < < a , where a is a number of bits to rotate where S 0 ′ , ... , S N − 1 ′ 190,191 are new state values; - calculating S t ′ = Y t ⊕ S N − 1 ′ , for t = 0,..., N - 2; and - outputting the last state S as a hash value h ; - calculating X t = ⊕ j = 0 N − 1 M r ⋅ N + t + δ j % N − j ⋅ N ⋅ x δ j mod p x , for t = 0, ... , N - 1, where δ ( j ) = j · ( j - 1)/2 for j > 0 and 0 for j = 0 and p(x) is a primitive polynomial of degree k where k is the size in bits of the key for the block cipher; - calculating S t = ⊕ j ≠ t S j , zero padded to k bits, for t = 0, ..., N - 1,; and - calculating X t ⊕ S t for t = 0, ..., N - 1 as the N block cipher keys. <EOS>