You can truncate the SHA-512 digest down to 256 bits though. Cryptographic hash functions mix well and don't suffer from the truncation (except to the extent that the truncated digest is shorter, of course). You don't necessarily need more storage (after hashing completes) just because you're using a new hash function.

> but 256 bits is already extremely strong

The strength of hashes like SHA-256 doesn't just come from the number of output bits.

The 256 bits there is relevant for brute force attacks, but not more sophisticated attacks that take into account the internal structure of the hash algorithm, and in some cases "weak" values.

SHA-512 performs more "rounds" of computation than SHA-256.

Although it's impossible to compare two different hashes on rounds alone, in general a large number of rounds of the same type of hash decreases the likelihood of non-brute-force attacks finding a collision.

If you look at the literature for attacks on hashes, they will often say they could do it for a certain number of rounds, and that number increases over time as new methods are discovered.

The number of rounds in the hash design is chosen with this in mind, trying to balance being more than sufficient for future attacks yet not too slow.

Cryptographic engineers do not in fact think you should use SHA-2-512 so that you can maximize the number of times the round function is applied.

I'm not sure what that sentence means, can you rephrase it?

The analysis you have provided for why SHA-512 is superior to SHA-256 is faulty.

The analysis was only supposed to explain why the 256-bit length of the hash output is not the sole determinant of a hash's strength. The parent was saying that, that's why it's quoted in my reply.

Pity it didn't come across that way.