[jakear]

Ya, SHA384 is the way to go. By discarding some bits, the internal state isn’t public and length extension becomes impossible.

[AtNightWeCode]

This is my understanding as well but I have seen claims that it is still very possible to do length attacks on SHA384.

[jakear]

Any reference for that? Based on the wiki it has 128 bits of security against length extension. https://en.m.wikipedia.org/wiki/SHA-2