[twotwotwo]

++ on SHA-512/256. SHA-512 uses 64-bit operations where SHA-256 uses 32-bit, so on a beefy 64-bit chip, it's faster per byte hashed. So, compared to SHA-256, more rounds, twice the state size, same familiar/widely-implemented design, and faster -- what's not to love?

See http://bench.cr.yp.to/results-hash.html for a comparison of hash-function speeds.

[cpeterso]

Thanks for the link. I was just about to ask the very ideation you answered. :)

[JoachimS]

Dang, just saw your reply which was better than mine.