Use a faster hash algorithm? about time-steward

[elidupree]

The new Wake model I'm currently looking at will massively reduce the number of hash operations that are necessary.

At the time I wrote that, I wasn't sure if HighwayHash was "possibly cryptographically secure but hasn't been researched enough yet"; right now, I can't find any cryptanalysis into HighwayHash, suggesting that maybe it was never secure enough that people would bother researching it.

Meanwhile, there's still not much hard evidence about SipHash128. I found a claim by a random person on the internet

SipHash128 is considered cryptographically secure (as of Mar 2020). It means that there is no better way to search for collisions than brute force.

And a claim that formerly existed in the SipHash repo readme:

SipHash with 128-bit tags targets PRF security with 128-bit key and 128-bit tags. In particular, any attack trying up to 2^s should succeed with probability at most 2^(s - 128).

But the claim in the current SipHash repo readme is conspicuously nonspecific on whether it includes SipHash128:

(Half)SipHash-c-d with c ≥ 2 and d ≥ 4 is expected to provide the maximum PRF security for any function with the same key and output size.

And nobody on the Internet knows why the maintainer removed the "experimental" label. That said, if someone had published a collision, I would presumably have been able to find it, so for the purposes of TimeSteward, I think I can assume that SipHash128 is "fine to use until proven otherwise"