isn't part of the point of SHA2 that it's more ARX-y? I don't know that the NSA has ever published the internal discussions which resulted in SHA2, but I alway

isn't part of the point of SHA2 that it's more ARX-y? I don't know that the NSA has ever published the internal discussions which resulted in SHA2, but I always thought the primary design purpose of SHA2 was to produce larger hashes (and thus avoid the 2^80 birthday attack on SHA1). Except: I don't know that "the SHA1 attacks could generalize" is all that valid a concern? It's not, now. It was in 2005/2006. Remember there wasn't just one SHA1 attack; there was a whole series of them. (And I'm guessing the NSA was particularly concerned given that some of the attacks were discovered by Chinese researchers.)