Why chose SHA512 over SHA384?

For practical purposes and the foreseeable future, both SHA384 and SHA512 are good enough for almost any imaginable collision-resistance application. Generally, the primary determining factor of what hash you would use, once we're above 256 bits and collision resistance is infinite for practical purposes, is just how many bits of output you need. For example, if you need the hash to generate both a 256-bit HMAC key and a 128-bit encryption key, SHA384 is a natural choice. If you need as much output as possible for the computational cost, say for output of a PRNG or as random padding, then SHA512 makes sense.


SHA512 also SHA256 SHA1 and MD5 are vulnerable to length extension attack SHA224 and SHA384 are not since reduced output to internal state, SHA3 is also not vulnerable. Having that in mind SHA512 is good cryptographic collision resistant hash function.


Certificates signed with SHA512 don't appear to work with TLS 1.2 on Windows (see here)

Therefore, I will be recreating my certificate chain using SHA-384 (or I suppose I could use SHA-256).

While thankfully, I have not released any certs yet, the thread in the linked page does propose a workaround/fix for those who are stuck with SHA-512.

HTH!