# Is SipHash cryptographically secure?

I'm evaluating different hash algorithms for use in my application. One of the kind of algorithms I am looking at are cryptographically secure ones to protect against DOS attacks.

SipHash seems pretty great, but the creators seem very careful to not call it "cryptographically secure".

In the SipHash paper (PDF), they call it “cryptographically strong”, but not secure. Is there any reason to trust SipHash over SpookyHash if both have no known DOS attacks and neither are “cryptographically secure”?

-

A fast 64-bit hash cannot be completely secure, since a $2^{32}$ brute force collision search is completely doable, and even a $2^{64}$ preimage attack could be feasible.

As a MAC used for hash table keying, that doesn't really matter (unless you leak the key). Finding just a few collisions isn't a problem and gathering statistics for an attack would probably already constitute a DOS attack.

-
Why say "fast"? It only blurs the (valid) argument IMHO. $\;$ +1 for the remark that SipHash could still be a cryptographically strong MAC. –  fgrieu Jul 4 at 6:16
@fgrieu, because whether $2^n$ operations is feasible in the real world depends on how long an operation takes. You could define a 64-bit hash function using $2^{96}$ iterations of SHA-256 (e.g. in PBKDF2) and a collision search would take the same time as that for SHA-256 (~$2^{128}$ SHA-256 operations). Since such a hash would be completely unusable, I suppose my hedging was unnecessary. –  otus Jul 4 at 6:29
Ah, yes, that's an excellent reason. –  fgrieu Jul 4 at 6:32