# Does SipHash have 64 bit (second) preimage security?

I was not able to find an explicit statement about the first and second preimage security of SipHash-2-4 or SipHash-4-8 anywhere.

I think it should be 64 bits, but I'd feel safer if somebody who has more experience with such hash functions could confirm this?

PS: I am aware that 64 bits can be broken, but I only need short term protection and I want to keep my packets small.

• What are "first and second preimage security of" a PRF? $\;$ – user991 May 2 '15 at 6:23
• Are you considering SipHash with the supposedly secret key gone public, making SipHash as hash, when normally SipHash is a MAC (aka Pseudo Random Function Family) rather than a hash (aka random public menber of a Pseudo Random Function Family) ? – fgrieu May 2 '15 at 6:51
• @Ricky Demer: The inventors of SipHash suggest to use it as a hash function (with a secret key). Typically, a secret key is chosen once, and from there on SipHash is used as a hash function. I am interested in the preimage security of that hash function. – Chris May 2 '15 at 7:00
• @fgrieu: Yes, that is exactly what I am interested in. – Chris May 2 '15 at 7:02

This does not answer the question of if preimage resistance of that SipHash-turned-hash can be broken much better than by brute force (expected $2^{64}$ evaluations of SipHash, which is not much); I simply do not know, and find it nontrivial to make an opinion other than: uncertain.