5 ms·

A variant are memory-hard PoW algorithms like Equihash. To calculate a hash you need a lot of memory which makes ASICs infeasible.

Animats 9y ago
No, it just means you need an ASIC attached to a lot of memory slots. You could probably use rejected DRAM, with a few bad bits, and save money.
- dragontamer 9y ago
  Memory-hard Crypto-coin PoW algorithms are usually latency-bound (ex: Cryptonight). So DDR4 RAM would be too slow compared to the L3 cache or L2 cache of CPUs. So this simple solution actually won't work on the harder algorithms. It might work for Ethash or something scrypt based, but things have gotten harder since then.
dragontamer 9y ago
I disagree. I've outlined my main points in a post on Reddit: https://www.reddit.com/r/Monero/comments/7x82yp/technical_cryptonight_discussion_what_about/ https://www.reddit.com/r/Monero/comments/7x82yp/technical_cr... In short: a memory-hard PoW algorithm (such as Cryptonight) can be gamed by using exotic low-latency memory like RLDRAM3, QDR-IV, or Hybrid Memory Cube. Its not as many orders-of-magnitude better than BTC, but it'd probably be on the order of 1x to 10x more power-efficient in the case of RLDRAM3. Although due to the costs of developing an ASIC and buying expensive RAM like RLDRAM3, it would likely cost a bit more than commodity hardware. You'd make it up eventually in energy savings however. The recent Hybrid Memory Cube RAM looks incredibly fast and power-efficient however. I wouldn't be surprised if HMC + FPGAs or ASICs completely destroys any "ASIC-resistance". Fortunately for the cryptocoin community, HMC is incredibly exotic, expensive, and rare at the moment.
- DSingularity 9y ago
  Look at Vertcoin and their adaptive tuning of the scrypt hash parameters based on difficulty.
  - dragontamer 9y ago
    QDR-IV has lower-latency than L3 cache from CPUs. And you can achieve higher-bandwidth arbitrarily by simply talking to more QDR-IV chips. The harder the memory-problem becomes, the better it is for QDR-IV SRAM compared to CPUs or GPUs. An ASIC or FPGA designer can use any RAM that exists in the world, but CPU / GPU users are limited to DDR3, DDR4, the L1/L2/L3 caches, GDDR5, and maybe HBM2 (AMD Vega / NVidia V100) Any memory-hard problem are basically solved by these exotic low-latency / high-bandwidth RAM chips + an FPGA or ASIC interfacing with them.
- _nalply 9y ago
  Thanks. It's really interesting. It seems that I posted a stupid comment. Sorry for that.
  - dragontamer 9y ago
    No one seems to know about RLDRAM3 yet in the cryptocoin community. Prior to my post a few days ago, I couldn't find any information on the subject (which is why I wrote something up on Reddit). I'm trying to bring up the issue actually, because I think its the obvious elephant in the room. In effect: ASICs are ALREADY made to solve the memory problem, they're called high-speed low-latency RAM (IE: RLDRAM3, QDR-IV, or HMC). But it seems like most people in the cryptocoin community is only familiar with DDR3, DDR4, or GDDR5 RAM. I think the "exotic" low-latency stuff is still not really well known yet.
    - AndrewBissell 9y ago
      I know Peter Todd has made some comments about how it would be pretty easy to build ASICs for memory-hard hashing algorithms, but my few seconds of Googling hasn't turned it up. Plenty of old hands will acknowledge that ASIC resistance may be a pipe dream for any coin which amasses sufficient economic value.
- wmf 9y ago
  It's interesting that you didn't consider internal SRAM; 2 MB of SRAM is less than 10 mm2 in a 10 nm process so an entire CryptoNight core might be ~12 mm2. This would be roughly twice the area efficiency of x86.
  - dragontamer 9y ago
    QDR-IV is SRAM. I think buying QDR-IV and externally interfacing would be easier. But I haven't thought too much about this aspect of the problem. In effect, QDR-IV already exists and is already mass produced. So if you wanted SRAM, there it is. Already to order from numerous suppliers. I don't see much reason why you'd want to design it into an ASIC when its a ready off-the-shelf part. Overall, I think the optimal design would use RLDRAM3 anyway. RLDRAM3 is cheaper and uses less Watts than QDR-IV. The tRC latency issue on RLDRAM3 doesn't seem to affect the expected workload of a memory-heavy Cryptocoin, so QDR-IV (aka SRAM) wouldn't have much of an advantage over RLDRAM3 anyway.

Animats 9y ago

No, it just means you need an ASIC attached to a lot of memory slots. You could probably use rejected DRAM, with a few bad bits, and save money.

dragontamer 9y ago
Memory-hard Crypto-coin PoW algorithms are usually latency-bound (ex: Cryptonight). So DDR4 RAM would be too slow compared to the L3 cache or L2 cache of CPUs. So this simple solution actually won't work on the harder algorithms. It might work for Ethash or something scrypt based, but things have gotten harder since then.

dragontamer 9y ago

I disagree. I've outlined my main points in a post on Reddit: https://www.reddit.com/r/Monero/comments/7x82yp/technical_cryptonight_discussion_what_about/ https://www.reddit.com/r/Monero/comments/7x82yp/technical_cr... In short: a memory-hard PoW algorithm (such as Cryptonight) can be gamed by using exotic low-latency memory like RLDRAM3, QDR-IV, or Hybrid Memory Cube. Its not as many orders-of-magnitude better than BTC, but it'd probably be on the order of 1x to 10x more power-efficient in the case of RLDRAM3. Although due to the costs of developing an ASIC and buying expensive RAM like RLDRAM3, it would likely cost a bit more than commodity hardware. You'd make it up eventually in energy savings however. The recent Hybrid Memory Cube RAM looks incredibly fast and power-efficient however. I wouldn't be surprised if HMC + FPGAs or ASICs completely destroys any "ASIC-resistance". Fortunately for the cryptocoin community, HMC is incredibly exotic, expensive, and rare at the moment.

DSingularity 9y ago
Look at Vertcoin and their adaptive tuning of the scrypt hash parameters based on difficulty.
- dragontamer 9y ago
  QDR-IV has lower-latency than L3 cache from CPUs. And you can achieve higher-bandwidth arbitrarily by simply talking to more QDR-IV chips. The harder the memory-problem becomes, the better it is for QDR-IV SRAM compared to CPUs or GPUs. An ASIC or FPGA designer can use any RAM that exists in the world, but CPU / GPU users are limited to DDR3, DDR4, the L1/L2/L3 caches, GDDR5, and maybe HBM2 (AMD Vega / NVidia V100) Any memory-hard problem are basically solved by these exotic low-latency / high-bandwidth RAM chips + an FPGA or ASIC interfacing with them.
_nalply 9y ago
Thanks. It's really interesting. It seems that I posted a stupid comment. Sorry for that.
- dragontamer 9y ago
  No one seems to know about RLDRAM3 yet in the cryptocoin community. Prior to my post a few days ago, I couldn't find any information on the subject (which is why I wrote something up on Reddit). I'm trying to bring up the issue actually, because I think its the obvious elephant in the room. In effect: ASICs are ALREADY made to solve the memory problem, they're called high-speed low-latency RAM (IE: RLDRAM3, QDR-IV, or HMC). But it seems like most people in the cryptocoin community is only familiar with DDR3, DDR4, or GDDR5 RAM. I think the "exotic" low-latency stuff is still not really well known yet.
  - AndrewBissell 9y ago
    I know Peter Todd has made some comments about how it would be pretty easy to build ASICs for memory-hard hashing algorithms, but my few seconds of Googling hasn't turned it up. Plenty of old hands will acknowledge that ASIC resistance may be a pipe dream for any coin which amasses sufficient economic value.
wmf 9y ago
It's interesting that you didn't consider internal SRAM; 2 MB of SRAM is less than 10 mm2 in a 10 nm process so an entire CryptoNight core might be ~12 mm2. This would be roughly twice the area efficiency of x86.
- dragontamer 9y ago
  QDR-IV is SRAM. I think buying QDR-IV and externally interfacing would be easier. But I haven't thought too much about this aspect of the problem. In effect, QDR-IV already exists and is already mass produced. So if you wanted SRAM, there it is. Already to order from numerous suppliers. I don't see much reason why you'd want to design it into an ASIC when its a ready off-the-shelf part. Overall, I think the optimal design would use RLDRAM3 anyway. RLDRAM3 is cheaper and uses less Watts than QDR-IV. The tRC latency issue on RLDRAM3 doesn't seem to affect the expected workload of a memory-heavy Cryptocoin, so QDR-IV (aka SRAM) wouldn't have much of an advantage over RLDRAM3 anyway.