It's worst cast in the model of security that hash tables are usually evaluated under. The authors of Siphash state as much: > Stopping advanced hash flooding.

It's worst cast in the model of security that hash tables are usually evaluated under. The authors of Siphash state as much: > Stopping advanced hash flooding. The _worst possible_ exposure of hash-table indices would simply show the attacker H(m) mod `for any attacker-selected string m. We advocate protecting against this maximum possible exposure, so that applications do not have to worry about how much exposure they actually provide. The attacker’s goal, given this exposure, is to find many strings m having a single value H(m) mod `. https://131002.net/siphash/siphash.pdf https://131002.net/siphash/siphash.pdf They also state that the "Target applications include network traffic authentication and hash-table lookups protected against hash-flooding denial-of-service attacks". It's nice to have a fast random hash function, that is also reasonably cryptographically strong, in case an attacked gets access to the hash values. That doesn't mean it's as cryptographically strong as hash functions specifically designed for full exposure. I'm just saying, use it for hash-tables, but don't use it as a general replacement for HMAC-SHA-1 in your encryption schemes. At least I don't see the authors recommending that anywhere.