Any idea why SHA384 is used over SHA256? Presumably it's not for collision avoidance, and it's not like anyone's going to be hitting the maximum message size o

Any idea why SHA384 is used over SHA256? Presumably it's not for collision avoidance, and it's not like anyone's going to be hitting the maximum message size of SHA256 with anything stored in CDN.. Edit: So it seems that all of the main variants of the SHA-2 family must be supported[1], and the spec supports multiple hashes being presented at once. It's just that SHA-384 seems to be used in all of the examples I've seen so far. > Conformant user agents MUST support the SHA-256, SHA-384 and SHA-512 cryptographic hash functions for use as part of a request’s integrity metadata, and MAY support additional hash functions. > When a hash function is determined to be insecure, user agents SHOULD deprecate and eventually remove support for integrity validation using that hash function. User agents MAY check the validity of responses using a digest based on a deprecated function. 1: http://www.w3.org/TR/SRI/#cryptographic-hash-functions http://www.w3.org/TR/SRI/#cryptographic-hash-functions