SipHash 4-8 is documented by the authors as being about half the speed of SipHash 2-4 and is obviously the more conservative option.

I was wondering from a security perspective how this would compare with performing SipHash 2-4 with two different keys and XOR-ing the outputs? Albeit one would need 2 128-bit keys (as opposed to 1 128 bit key for 4-8), but one could then perform the individual hashes in parallel.

My intuition would be that even if there were an attack that breaks SipHash 2-4, the doubled key length would require that the attack reduce the security by at least half in order for this parallel construction to be less secure than SipHash 4-8.

Would this generalize as well to other MACs that use "rounds" of some form (e.g. KMAC could be represented in this way, HMAC not really)?



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.