I was reading about the Miyaguchi-Preneel scheme and had difficulty in understanding why the compression function, $h(H,m)=E(H, H \oplus M) \oplus M \oplus H$ can be called secure. The only resource I could find about this was Black-Box Analysis of the Block-Cipher-Based Hash-Function Constructions from PGV.
Again, I am having trouble with the explanation provided there. So, if someone could please clear my doubt, that would be great, thanks!
