4 ms·
>An "expensive" hash function like scrypt provides both the user and the attacker the same slowdown/cost multiplier. That's not true. Scrypt is designed to mak
by hanbura 9y ago
>An "expensive" hash function like scrypt provides both the user and the attacker the same slowdown/cost multiplier.
That's not true. Scrypt is designed to make computing it in parallel on the GPU expensive while keeping CPU computation reasonably fast.
Thus attackers are exposed to a much higher slowdown, since just about no login server uses GPUs
- garmaine 9y ago> That's not true. Scrypt is designed to make computing it in parallel on the GPU expensive while keeping CPU computation reasonably fast. It failed at this, FYI. It turns out that scrypt silicon requires larger dies than a straight hash function like sha256, and the larger dies mean better heat dissipation, which means greater performance per watt. Scrypt attackers get a larger advantage vs cpu validators than a salted hash function. Oops.
- java-man 9y agoInteresting. Can you point to the source on this? Thanks!
- garmaine 9y agoYou can calculate yourself the efficiency of scrypt ASICs vs CPU mining based on published performance numbers. For an explanation of the many reasons why this is the case, here's two starting points for that rabbit hole: https://www.reddit.com/r/Bitcoin/comments/3n5nws/research_paper_asymmetric_proofofwork_based_on/ https://www.reddit.com/r/Bitcoin/comments/3n5nws/research_pa... https://crypto.stackexchange.com/questions/29890/memory-hard-proof-of-work-are-they-asic-resistant https://crypto.stackexchange.com/questions/29890/memory-hard...