256 bits is enough collision resistance, so I don't mind truncating SHA-512, even down to 256 bits. If you find collision space reduction interesting, then you

256 bits is enough collision resistance, so I don't mind truncating SHA-512, even down to 256 bits. If you find collision space reduction interesting, then you might find it even more interesting that truncating SHA-512 makes it more secure not less. This (and the higher rounds safety margin) is why I choose truncated SHA-512 over SHA-256 for this sort of application, even though the number of output bits is the same: Check out the red boxes on https://en.wikipedia.org/wiki/Template:Comparison_of_SHA_functions https://en.wikipedia.org/wiki/Template:Comparison_of_SHA_fun...