Hash Flooding a Randomized Modular Hash Table

Question

Assume we have a hash table using the function h(x) = x mod 32. h(x) = x mod 33. Also assume it dynamically resizes by doubling the amount of buckets and rehashing. If I was able to provide inputs for the hash table it would be really easy to flood with colliding entries to slow lookups to O(n).

However, say we were to xor each input with a random pepper before hashing. If the input is ever longer than the pepper we just generate more random pepper dynamically.

If this hash function is used on some server somewhere and people have the ability to supply it with entries, is it (relatively) safe from algorithmic complexity attacks? Is it vulnerable to any special attacks that don't work on SipHash?

More broadly speaking, how are keyed hash functions better than hash randomization for deterring hash flooding complexity attacks?

Edit: As pointed out by bmm6o, it turns out that h(x) = x mod 32 has no scrambling properties whatsoever when used in conjunction with xor, which partially answers my question. Other modulos that are not a power of two still work but the extent of the scrambling is unclear.

Answer 1

If this hash function is used on some server somewhere and people have the ability to supply it with entries, is it (relatively) safe from algorithmic complexity attacks?

No, here is one attack funnels all entries into 33 slots (even if there were 10,000 entries):

Have the attacker submit 10,000 entries that all end with 16 zeros (actually, it doesn't matter what the end is, it just needs to be consistent with the entries).

When you apply the pepper, you end up with 10,000 entries with the same lower 16 bits (what those bits are depend on the pepper).

Then, you compute each entry $x$ modulo $33 \cdot 2^k$ (where $k$ is the number of resizings you've done). If $k \le 16$, this result will be one of 33 possible values, and so your hash function will try to place everything into those 33 places.