I read this in the documentation of HighwayHash:
By contrast, 'strong' hashes such as SipHash or HighwayHash require infeasible attacker effort to find a hash collision (an expected 2^32 guesses of m per the birthday paradox) or recover the seed (2^63 requests). These security claims assume the seed is secret. It is reasonable to suppose s is initially unknown to attackers, e.g. generated on startup or even per-connection. A timing attack by Wool/Bar-Yosef recovers 13-bit seeds by testing all 8K possibilities using millions of requests, which takes several days (even assuming unrealistic 150 us round-trip times). It appears infeasible to recover 64-bit seeds in this way.
/\ This is talking about 64-bits output.
Let's suppose I take a 256-bits seed full of entropy from Linux
/dev/hwrng and hash with a (cryptographic) hash function.
Based on that said above, can the adversary brute-force the seed space and find a collision with 2^128 guesses (128-bits)? Or will it have to brute-force the entire seed space to find the matching key (256-bits)?
This question could sound obvious, but the documentation of HighwayHash made me confused.
/dev/hwrng? The NSA don't like that kinda stuff. $\endgroup$