Cryptanalysis of Meow Hash

• meow_hash

  13 1,684 0.0 C++

  Official version of the Meow hash, an extremely fast level 1 hash

The original announcement post of Meow Hash from 2018 at https://mollyrocket.com/meowhash said:

> […] we wanted a fast, non-cryptographic hash for use in change detection and deduplication.

and

> To our surprise, we found a lack of published, well-optimized, large-data hash functions. Most hash work seems to focus on small input sizes (for things like dictionary lookup) or on cryptographic quality.

and also

> The Meow hash is not designed for cryptography and therefore we make no claims about its security. Assume it is completely insecure.

I found it confusing then that the cryptanalysis of Meow Hash posted here said:

> The creators make a few security claims; we will break them all. In particular, we present three main attacks […]

But then looking at the Meow Hash GitHub repo I see in the README:

> Due to recent discoveries by Peter Schmidt-Nielsen, we have decided to reclassify Meow hash 0.5/calico from level 3 to level 1. This means that we recommend not to use this hash for message authentication codes, or for hash tables in scenarios where collision induced denial-of-service attacks are a concern.

> We have seen no evidence that the hash is unfit for non-adversarial/non-cryptographic purposes, and continue to believe that it is amongst the best in this regard.

> For level 3/MAC capabilities consider migrating to SipHash. Do not migrate to any hash not advertising MAC capabilities as these are almost certainly much weaker than Meow 0.5. If the performance of SipHash is not satisfying, continuing to use Meow 0.5 for hash tables is better than migrating to another fast hash. While Meow 0.5 also continue to provide some useful strength for message authentication codes, we have to stress that we strongly recommend migration in this case.

So I guess at some point the creators of Meow Hash made some claims about Meow Hash being suitable in cryptographic context between the original announcement and now.

Either way, it’s nice to see that stuff like this is being looked after and responded to, and to know about where I may want to use Meow Hash and not.

• InfluxDB

  www.influxdata.com featured

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

Suggest a related project