That was informative, thanks! It matched my gut feeling about the algorithms and I knew some of these things, but not everything :) > a safe bet is still SHA-5

That was informative, thanks! It matched my gut feeling about the algorithms and I knew some of these things, but not everything :) > a safe bet is still SHA-512/256, which is safe against length extension attacks. I would like to add here that this does not mean "SHA-512 or SHA-256" (I remembered that SHA-256 was not length-extension resistant and looked up the details). Instead, it means the version of SHA-512 that gets truncated to 256 bits. This is apparently relatively new (or at least added after I last read up on SHA-2): > In March 2012, the standard was updated in FIPS PUB 180-4, adding the hash functions SHA-512/224 and SHA-512/256, and describing a method for generating initial values for truncated versions of SHA-512. -- https://en.wikipedia.org/wiki/SHA-2#Hash_standard https://en.wikipedia.org/wiki/SHA-2#Hash_standard I feel like that notation could have been chosen better by NIST.