[jakear]

Any reference for that? Based on the wiki it has 128 bits of security against length extension. https://en.m.wikipedia.org/wiki/SHA-2