FAQ

Can I turn the MiMC block cipher into a single-call block-cipher-based compression function, using a mode like Miyaguchi-Preneel, Matyas-Meyer-Oseas, Davies-Meyer, or similar?

In our original paper we propose to instantiate a hash function via plugging the MiMC permutation into a Sponge construction. The reason back then was security analysis. A mode like Miyaguchi-Preneel makes it harder, and in 2016 we did not feel confident in proposing this. In the meanwhile we did more security analysis, improving our understanding and confidence, but our recommendation remains unchanged.

If you really prefer to use a block-cipher-based compression function design because of the smaller field size it allows compared to a Sponge approach, we'd recommend more rounds for MiMC. Of course, depending on your application this might or might not offset gains from working in a smaller field.