HMAC-SHA-256 vs SHA-512/256 vs truncated SHA-512 for use as a MAC I'm looking at three options for shared-secret message authentication codes:


HMAC-SHA-256(secret, payload)
SHA-512/256(secret+payload)
SHA-512(secret+payload) truncated to 256 bits


Option 1 is the most standard choice.  I'm considering option 2 because it is faster on 64-bit CPUs.  I'm considering option 3 because SHA-512 is more widely available in programming language libraries than SHA-512/256.

Are options 2 and 3 appropriate for MACs?  Are there any security-related reasons to pick one over the other?

Clarification: I realize that a good HMAC-SHA-256 implementation is not significantly slower than SHA-256.  I'm considering options 2 and 3 because SHA-512 is faster than SHA-256 on 64-bit machines (link).

Background: Some cryptographic hash functions (like SHA-256 and SHA-512) are "length-extendable".  This is not necessarily a problem because correct uses of a hash function should not be affected by that property.  But you can't use such a hash function directly as a MAC because, in that use case, the signature and input both come from an untrusted source (length extension attack).

SHA-512/256 is a hash function based on SHA-512 that is not length-extendable.  (It's similar to running SHA-512 and only using the first 256 bits of output, which is also not length-extendable.)  My question was whether these two hash functions could be directly used as MACs.
Option 2 and 3 are appropriate for a MAC, assuming the length of the key is not variable (otherwise appropriate padding must be used, similar to that used in KMAC). In this manner, it behaves like SHA-3 which does not need to be run in the usual nested HMAC construction. Numbers 2 and 3 are actually virtually identical. The only difference is that SHA-512/256 uses a different IV than plain truncated SHA-512. They all provide protection against length extension attacks.

Note that you can optimize HMAC to reduce the number of calls to the hash. Any decent implementation will not have significantly impaired performance compared to HMAC-SHA-256. You can also get away with only executing a single SHA-256 function using an older construction called an envelope MAC which concatenates the key, message, and key again, with padding.