# Does SipHash have 64 bit (second) preimage security?

I was not able to find an explicit statement about the first and second preimage security of SipHash-2-4 or SipHash-4-8 anywhere.

I think it should be 64 bits, but I'd feel safer if somebody who has more experience with such hash functions could confirm this?

PS: I am aware that 64 bits can be broken, but I only need short term protection and I want to keep my packets small.

• What are "first and second preimage security of" a PRF? $\;$ – user991 May 2 '15 at 6:23
• Are you considering SipHash with the supposedly secret key gone public, making SipHash as hash, when normally SipHash is a MAC (aka Pseudo Random Function Family) rather than a hash (aka random public menber of a Pseudo Random Function Family) ? – fgrieu May 2 '15 at 6:51
• @Ricky Demer: The inventors of SipHash suggest to use it as a hash function (with a secret key). Typically, a secret key is chosen once, and from there on SipHash is used as a hash function. I am interested in the preimage security of that hash function. – Chris May 2 '15 at 7:00
• @fgrieu: Yes, that is exactly what I am interested in. – Chris May 2 '15 at 7:02

SipHash is a MAC (aka Pseudo Random Function Family) with 64-bit output and 128-bit key, rather than a hash (aka random public member of a Pseudo Random Function Family). It is explicitly designed to be used with a secret random key. Quoting Jean-Philippe Aumasson and Daniel J. Bernstein's SipHash: a fast short-input PRF (in proceedings of Indocrypt 2012):

the standard PRF and MAC security goals allow the attacker access to the output of SipHash on messages chosen adaptively by the attacker. However, they do not allow access to any "leaked" information such as bits of the key or the internal state. They also do not allow "related keys", "known keys", "chosen keys", etc.

Thus you are without endorsement of the creators if using SipHash as a hash function and expecting 64-bit second preimage resistance when the key has gone public (as you would legitimately for a 64-bit hash function).

This does not answer the question of if preimage resistance of that SipHash-turned-hash can be broken much better than by brute force (expected $2^{64}$ evaluations of SipHash, which is not much); I simply do not know, and find it nontrivial to make an opinion other than: uncertain.

• Thanks for your answer! Indeed, the paper only contains the weak hint: "A basic advantage of the JH/SipHash injection structure compared to the sponge/Keccak [7] injection structure is that message blocks of arbitrary length (up to half the state) can be absorbed without reducing preimage security." - I guess that since one cannot compute anything at all without the secret key, this must be referring to preimage security with knowledge of the key. Further comments on this are welcome! – Chris May 2 '15 at 10:40