[CFRG] SipHash recommendation?

[Benjamin Kaduk <[e-mail]>]

Hi all,

We have a document (draft-ietf-dnsop-server-cookies) in front of the IESG
that proposes to use the SipHash-2-4 algorithm
(https://www.aumasson.jp/siphash/,
https://www.aumasson.jp/siphash/siphash.pdf) as a MAC over what is in some
sense a return-routability and freshness token, the "DNS cookie" originally
specified in RFC 7873.

Unfortunately, the authors of this draft have not yet written down a clear
description of what properties they believe are needed from this MAC for
this usage, which makes it slightly hard to confirm that SipHash is a
suitable algorithm for this purpose, though that is certainly a question
that I am interested in.

Regardless of that, I would also like to get the CFRG's input on whether
SipHash is a suitable algorithm for its stated goals (paraphrasing
slightly): a performant keyed (family of) PRF suitable for use as a MAC,
with the security goal for a MAC being considered to be that an attacker,
even after seeing tags for many messages (perhaps selected by the
attacker), is unable to guess tags for any other messages.

In short: is SipHash fit for this purpose?

There does seem to be a decent amount of literature analyzing SipHash, but
I have not attempted to review it to any significant degree.

Thanks,

Ben