Let's say I need performance on 64-bit machine, then SHA3-512 is the way to go. SHA-512/256(x) is SHA-512(x) with output truncated to 256 bits, according to https://pycryptodome.readthedocs.io/en/latest/src/hash/sha512.html Let H1(x) be SHA-512/256(SHA-512(SHA-512(x))) Let H2(x) be SHA-256(SHA-51...