With Cuckoo Cycle, you pair every siphash evaluation (mapping 64 bits to 64 bits; a much cheaper hash function than SHA1 by an order of magnitude) with a rando

With Cuckoo Cycle, you pair every siphash evaluation (mapping 64 bits to 64 bits; a much cheaper hash function than SHA1 by an order of magnitude) with a random memory access. As a result, most of the power consumption will be from the memory subsystem. I believe a DRAM chip draws on the order of 1W. So you should be able to run this on a smartphone, while it's charging overnight.