What was the case against SHA-512/256? It's the same size as SHA-256, is faster on 64-bit hardware, and is often more difficult to attack. It's just a truncated

What was the case against SHA-512/256? It's the same size as SHA-256, is faster on 64-bit hardware, and is often more difficult to attack. It's just a truncated SHA-512 hash, which is widely supported. The only drawback I know of is that it's slower than SHA-256 on 32-bit hardware. edit: I found the email where they compared 256-bit hash functions [1]. It seems Apple Common Crypto, gcrypt and NSS don't implement SHA-512. A new twist to the performance story is that OpenSSL's SHA-256 is faster than SHA-512/256 in the AMD Ryzen tests, possibly due to the recent introduction of hardware support. [1]: https://public-inbox.org/git/20180609224913.GC38834@genre.crustytoothpaste.net/ https://public-inbox.org/git/20180609224913.GC38834@genre.cr...