
SHA-512 is 1.5x faster than SHA-256 on 64-bit platforms - steffenweber
http://crypto.stackexchange.com/questions/26336/sha512-faster-than-sha256
======
kobeya
"... amortized per byte."

SHA-512 is in fact slower per iteration, but uses twice the block size as
SHA-256. For hashing e.g. files, the per-byte number is what matters. But when
doing hash trees, for example, the per-iteration performance is what matters
and SHA-256 wins out there.

------
dchest
Similarly:

    
    
        BLAKE2s (32-bit words) - 554 MiB/s
        BLAKE2b (64-bit words) - 890 MiB/s
    

(source: [https://blake2.net/](https://blake2.net/))

The difference is also clear in pure JavaScript implementations — JS doesn't
have native 64-bit integer operations yet, so SHA-512 is slower there:

    
    
       SHA-256 - 103.17 MiB/s
       SHA-512 -  34.29 MiB/s
    
    

Note that since SHA-512 eats 128-byte blocks, while SHA-256 64-byte blocks,
hashing very short strings may be faster with SHA-256 even on 64-bit platforms
(the same applies to BLAKE2).

~~~
shakna
> in pure JavaScript implementations

Is not JS cryptography a bad idea?

~~~
angry_octet
No JS per se. In browser client side crypto though...

~~~
gcp
Harder to defend against timing attacks in JS, which are exactly some of the
strongest attacks against modern cryptosystems.

~~~
angry_octet
Do you mean because of the lack of low level control/bit manipulation, vs
C/asm, or something else? I would have guessed it was about the same as any
interpreted/jitted higher level language (python/php/c#/java).

------
loeg
Yep. Taking advantage of SHA512's superior performance while still producing a
256 bit result is the raison d'être of SHA-512/256.

~~~
meta_AU
Well... only if you ignore the advantages of immunity to length extension.

------
joshuak
We use this fact in our ID system. Consider bloom filters... so many different
'hash functions' you get for free out of 64 bytes of hash data.

------
hyh1048576
As a side note, there are some cryptocurrency project using half of the
sha512, since it's faster and using a 256 bit hash saves spaces.

------
nstr10
I would be curious to see this compared with SHA-384, and across multiple
languages.

~~~
cperciva
SHA-384 is exactly the same speed as SHA-512. SHA-512/256 is also the same
speed -- it's basically SHA-512 with the output truncated to 256 bits.

