The length extension attack is a non-issue for Git’s use case, and SHA-256 (unlike SHA-512) benefits from having hardware acceleration in the new Ice Lake Intel

The length extension attack is a non-issue for Git’s use case, and SHA-256 (unlike SHA-512) benefits from having hardware acceleration in the new Ice Lake Intel chips (as well as on the AMD side of things), and has been around 11 years longer than SHA-512/256. And, yes, there are places which say “If you will use a hash, you will use SHA-256”. Personally, the last time I was in a place where I had to choose which cryptography to use, I used SHA3’s direct predecessor, RadioGatún, because I needed a combined hash + stream cipher and, at the time (late 2007), RadioGatún was the only option. RadioGatún also benefits from being about as fast as BLAKE2 (it would be faster in hardware, FWIW, having SHA3’s hardware advantages), and is approaching 14 years old without being broken by cryptoanalysis. Also, unlike BLAKE2/3, and like SHA3 and all sponge functions, it’s computationally expensive to “fast forward” in RadioGatún’s XOF (stream cipher, if you will) mode, which is beneficial for things like password hashing. Another nice thing about RadioGatún: It doesn’t have any magic constants in its specification, allowing a useful implementation to fit on my coffee mug, e.g. #include<stdio.h>//RadioGatun #include<stdint.h>/*32-bit**/ #define b(z) for(c=0;c<z;c++) uint32_t c,e[42],f[42],g=19,h =13,n[45],i,j,k;void m(){j=0; b(12)f[c+c%3*h]^=e[c+1];b(g){ i=c*7%g;k=e[i++];k^=e[i%g]|~e [(i+1)%g];j=j+c;n[c]=n[c+g]=k >>j%32|k<<-j%32;}for(i=39;i-- ;f[i+1]=f[i])e[i]=n[i]^n[i+1] ^n[i+4];b(3)e[c+h]^=f[c*h]=f[ c*h+h];*e^=1;}int main(int c, char**v){char*q=v[--c];for(;; m()){b(3){for(j=0;j<4;){f[c*h ]^=k=(*q?255&*q:1)<<8*j++;e[c +16]^=k;if(!*q++){b(18)m();b( 8){j=c;b(4)printf("%02x",(e[1 +j%2]>>8*c)&255);c=j;if(c%2)m ();}return 0&puts("");}}}}}// If someone asked me which hash algorithm to use, I would suggest SHA-256, unless I think they needed protection from length extension attacks (so SHA-512/256), or needed an XOF (stream cipher-like) construction (so SHAKE256). If performance mattered more than a conservative security margin, BLAKE3 (software performance) or KangarooTwelve (SHA3 variant; excellent hardware performance) would be good choices. If I were to do choose a hash + XOF for use today, I would use KangarooTwelve’s variant with a little larger security margin: MarsupilamiFourteen.