1
$\begingroup$

SipHash 4-8 is documented by the authors as being about half the speed of SipHash 2-4 and is obviously the more conservative option.

I was wondering from a security perspective how this would compare with performing SipHash 2-4 with two different keys and XOR-ing the outputs? Albeit one would need 2 128-bit keys (as opposed to 1 128 bit key for 4-8), but one could then perform the individual hashes in parallel.

My intuition would be that even if there were an attack that breaks SipHash 2-4, the doubled key length would require that the attack reduce the security by at least half in order for this parallel construction to be less secure than SipHash 4-8.

Would this generalize as well to other MACs that use "rounds" of some form (e.g. KMAC could be represented in this way, HMAC not really)?

$\endgroup$

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.