Thank you for reply. Then I suppose re-using the SHA2 primitive doesn't make much sense, except perhaps in awkwardly constrained environments (area starved ASI

Thank you for reply. Then I suppose re-using the SHA2 primitive doesn't make much sense, except perhaps in awkwardly constrained environments (area starved ASIC/FPGA, embedded processor with accelerated SHA, etc). Regardless, it's interesting to know that the mixing function can be swapped around.