HKDF Bit Security

Question

I've always understood the bit security of hash functions to be related to their output size (eg. collision resistance). However, I recently came across a table from a Wickr blog post that lists HKDF-SHA256 as having 256 bits of security. Here's the table:

1. How does this work when HMAC-SHA256 offers 128-bit security? Is this due to the input keying material size being used?
2. What would the security of keyed BLAKE2b be - do the same rules as HMAC apply?
3. What would the security of BLAKE2b as a KDF be (eg. the libsodium implementation with a salt and personalisation)?

For example, does a 256-bit key provide 256 bits of security even if the tag is only 256-bit (typically 128-bit collision resistance)?

I can't find any mention of these details for keyed BLAKE2, but an unkeyed 256-bit output has 128-bit collision resistance according to the RFC:

        Algorithm     | Target | Collision | Hash | Hash ASN.1 |
           Identifier |  Arch  |  Security |  nn  | OID Suffix |
       ---------------+--------+-----------+------+------------+
        id-blake2b160 | 64-bit |   2**80   |  20  |   x.1.5    |
        id-blake2b256 | 64-bit |   2**128  |  32  |   x.1.8    |
        id-blake2b384 | 64-bit |   2**192  |  48  |   x.1.12   |
        id-blake2b512 | 64-bit |   2**256  |  64  |   x.1.16   |

Please don't answer with a bunch of math. I'm not good at math. I'm a developer, not a mathematician.

Answer 1

For collision resistance, the bit security of a hash function is half the length of its output. This is because one can find a collision in any hash function of output length $n$ in time $2^{n/2}$. That is why the bit security of SHA256 with respect to its primary security property of collision resistance is 128. However, this doesn't mean that SHA256 cannot be used for other purposes and achieve higher bit security. In particular, for HKDF, the bit security of the output is essentially that of the input (up to a maximum of 256 bits, which is the output length). So, if you use HKDF on an input key of size 128 bits (or a string of entropy 128) then you receive an output key with 128 bits of security. If you use HKDF on an input key of size 256 bits (or a string of entropy 256) then you receive an output key with 256 bits of security. Note that in all cases the output of SHA256 is 256 bits, so if you need a shorter result (e.g., when using a 128-bit key) then the result needs to be truncated as specified in HKDF.