Reference:Advances in Cryptology — CRYPTO 2008. LNCS vol. ????, pp. ???-???, 2008.
Abstract: We propose a family of compression functions built from fixed-key blockciphers and investigate their collision and preimage security in the ideal-cipher model. The constructions have security approaching and in many cases equaling the security upper bounds found in previous work of the authors. In particular, we describe a $2n$-bit to $n$-bit compression function using three $n$-bit permutation calls that has collision security $N^{0.5}$, where $N=2^n$, and we describe $3n$-bit to $2n$-bit compression functions using five and six permutation calls and having collision security of at least $N^{0.55}$ and $N^{0.63}$.
Rogaway's home page.