3 of 8
edited title

In what aspects is the function based on four iterations of SHA-256 compression function weaker than the SHA-512 compression function?

Let $F_{512}(B)$ denote the underlying function (single block manipulation function) of SHA-256. This function takes a 512-bit input $B$ and produces 256 pseudo-random bits (eight 32-bit words). Then I can define the following function (that operates on a 1024-bit input $B$ and outputs 512 pseudo-random bits):

$$G_{1024}(B) = (x_1 \oplus x_3) \mathbin\Vert (x_2 \oplus x_4),$$

where $$\begin{array}{l} {x_1} = F_{512}({B_1}),\\ {x_2} = F_{512}({x_1} \oplus {B_2}),\\ {x_3} = F_{512}({x_2} \oplus {B_1}),\\ {x_4} = F_{512}({x_3} \oplus {B_2}) \end{array}$$

and $B_i$ denotes the first/second half of the 1024-bit input.

Let $F_{1024}(B)$ denote the underlying function (single block manipulation function) of SHA-512. This function takes a 1024-bit input $B$ and produces 512 pseudo-random bits (eight 64-bit words).

Yes, $G_{1024}$ may be slower than $F_{1024}$, but is $G_{1024}$ weaker than $F_{1024}$ from the cryptographic point of view? If yes, in what aspects?