* Much faster than MD5, SHA-1, SHA-2, SHA-3, and BLAKE2.
* Secure, unlike MD5 and SHA-1. And secure against length extension, unlike SHA-2.
* Highly parallelizable across any number of threads and SIMD lanes, because it's a Merkle tree on the inside.
* Capable of verified streaming and incremental updates, again because it's a Merkle tree.
* A PRF, MAC, KDF, and XOF, as well as a regular hash.
* One algorithm with no variants, which is fast on x86-64 and also on smaller architectures.