I've always understood the bit security of hash functions to be related to their output size (eg. collision resistance). However, I recently came across a table from a Wickr blog post that lists HKDF-SHA256 as having 256 bits of security. Here's the table:
- How does this work when HMAC-SHA256 offers 128-bit security? Is this due to the input keying material size being used?
- What would the security of keyed BLAKE2b be - do the same rules as HMAC apply?
- What would the security of BLAKE2b as a KDF be (eg. the libsodium implementation with a salt and personalisation)?
For example, does a 256-bit key provide 256 bits of security even if the tag is only 256-bit (typically 128-bit collision resistance)?
I can't find any mention of these details for keyed BLAKE2, but an unkeyed 256-bit output has 128-bit collision resistance according to the RFC:
Algorithm | Target | Collision | Hash | Hash ASN.1 | Identifier | Arch | Security | nn | OID Suffix | ---------------+--------+-----------+------+------------+ id-blake2b160 | 64-bit | 2**80 | 20 | x.1.5 | id-blake2b256 | 64-bit | 2**128 | 32 | x.1.8 | id-blake2b384 | 64-bit | 2**192 | 48 | x.1.12 | id-blake2b512 | 64-bit | 2**256 | 64 | x.1.16 |
Please don't answer with a bunch of math. I'm not good at math. I'm a developer, not a mathematician.