4 ms·

I did an analysis of this PoW at my line of work and I would say that it is really complicated. Unnecessarily so, I have to add. I also have a comment about AS

by thesz 6y ago

I did an analysis of this PoW at my line of work and I would say that it is really complicated. Unnecessarily so, I have to add. I also have a comment about ASIC resistance. There are tools that allow to customize hardware upon programs it will execute, [1] is an example of one such tool, there are some others. [1] http://openasip.org/tta.html http://openasip.org/tta.html If you write a RandomX code generator and interpreter and customize the CPU hardware using tools like one above you will get an optimized version of the hardware. Take a look at [2] for a results of such codesign attempts for Fourier transform. The optimization in energy efficiency can be as high as 100+ times over general purpose processors and on par and exceeding ASIC implementation. [2] https://www.researchgate.net/publication/321700396_Codesign_case_study_on_transport-triggered_architectures https://www.researchgate.net/publication/321700396_Codesign_... One would duly note that RandomX employs floating point instructions in some parts of hashing process. I will respond that floating point operations can be expressed as operations on fixed point values and these hardware parts can (and will) be shared with other computations. Basically, the codesign tool will implement for you a split (FP)ALU. This will also increase energy efficiency over GPU and general purpose CPUs which have different paths for FP and integer computations and usually do not share ALU parts between these. To comclude, first, RandomX is needlessly complicated. Second, I think that ASIC version can be attained without writing everything in Verilog by hand, you may stick with C reference implementation for most of the work. And, last but not least, the gain in hashes per joule from ASIC implementation can be much higher than 2-5 times over CPU or GPU.

deepnotderp 6y ago
Comparing an FFT ASIC to a random code "ASIC" is.... well, just wrong.
- hyc_symas 6y ago
  Yep. His comment completely misses the point, and everything he mentions about codesign tools is irrelevant.
  - deleted 6y ago
    [deleted]
- thesz 6y ago
  Why do you think so? In TTA you have static schedule for what is achieved dynamically in x86 CPU, consuming energy. You can have much wider issue there, you can better utilize parts, allocating, for example, more shifters than is available on CPUs/GPUs. You may not be so lucky to achieve 800x energy efficiency gain, but getting ten times better than CPU is achievable.
Erlich_Bachman 6y ago
What do you mean by "needlessly" complicated? The whole point is to make it very complicated, as that is the main mechanism by which they achieve resistance to ASIC designs for it. How is that "needless"? Even if you say that an ASIC can still be built, the point it to make those ASICs much harder and more expensive to build. That coupled with regular change of PoW scheme (as is done in Monero) means that it is just economically unviable to develop ASICs for Monero.
- seanwilson 6y ago
  Likely they mean a combination of: - could be replaced with something with less moving parts that has the same properties - it's difficult to analyse because it has so many moving parts so there might be a fatal hiding somewhere Simple is good when you're looking to confirm the security of something. This likely counts even more for a cryptocurrency.
  - a1369209993 6y ago
    Confirm what security though? The only security property of a proof of work scheme is that a new N-proof cannot be created with less than N new (non-sharable) operations of a general-purpose computer, which is a vulnerablity that most current proof-of-work schemes already have in the form of specialized ASICs (hence TFA). RandomX may be even worse in this regard, but a significant amount of complexity is very much needful.
    - seanwilson 6y ago
      > Confirm what security though? For PoW, the important property seems to be that there's no shortcut to doing the hard work e.g. I could ask you to sum all the numbers from 1 to N for a very high number of N to prove you've done some work, but the flaw there is that a shortcut exists where where you only have to calculate (n(n+1))/2 to get the final answer in a fraction of the time. > significant amount of complexity is very much needful I think you're using the word complexity in a different way to the way I was using it. I'm guessing you probably mean "is difficult to calculate the result without taking a shortcut" and not "is conceptually simple to understand and analyse for flaws by a human". Ideally, you want both to be true but that won't be the case for all PoW processes.
q3k 6y ago
I also performed analysis of this algorithm as part of a work engagement, and came to similar conclusions to you (that it's not nearly as ASIC resistent as the authors claim). Notably there was (and still somewhat is, but less so [1]) very low data dependency between the generated instructions, which enables ahead-of-time preprocessing on a CPU to get effective execution on a bunch of independent compute units / datapaths (on an FPGA/ASIC), saturating all of them during a significant amount of time. [1] - https://github.com/tevador/RandomX/pull/118 https://github.com/tevador/RandomX/pull/118
- hyc_symas 6y ago
  So I guess you're referring to section 4.2 in the X41 audit report https://github.com/hyc/RandomxAudits/blob/master/Report-X41-20190705.pdf https://github.com/hyc/RandomxAudits/blob/master/Report-X41-... We already responded to the points you raised. https://github.com/hyc/RandomxAudits/blob/master/Comment-X41.md https://github.com/hyc/RandomxAudits/blob/master/Comment-X41...

by thesz 6y ago

deepnotderp 6y ago

Comparing an FFT ASIC to a random code "ASIC" is.... well, just wrong.

hyc_symas 6y ago
Yep. His comment completely misses the point, and everything he mentions about codesign tools is irrelevant.
- deleted 6y ago
  [deleted]
thesz 6y ago
Why do you think so? In TTA you have static schedule for what is achieved dynamically in x86 CPU, consuming energy. You can have much wider issue there, you can better utilize parts, allocating, for example, more shifters than is available on CPUs/GPUs. You may not be so lucky to achieve 800x energy efficiency gain, but getting ten times better than CPU is achievable.

Erlich_Bachman 6y ago

What do you mean by "needlessly" complicated? The whole point is to make it very complicated, as that is the main mechanism by which they achieve resistance to ASIC designs for it. How is that "needless"? Even if you say that an ASIC can still be built, the point it to make those ASICs much harder and more expensive to build. That coupled with regular change of PoW scheme (as is done in Monero) means that it is just economically unviable to develop ASICs for Monero.

seanwilson 6y ago
Likely they mean a combination of: - could be replaced with something with less moving parts that has the same properties - it's difficult to analyse because it has so many moving parts so there might be a fatal hiding somewhere Simple is good when you're looking to confirm the security of something. This likely counts even more for a cryptocurrency.
- a1369209993 6y ago
  Confirm what security though? The only security property of a proof of work scheme is that a new N-proof cannot be created with less than N new (non-sharable) operations of a general-purpose computer, which is a vulnerablity that most current proof-of-work schemes already have in the form of specialized ASICs (hence TFA). RandomX may be even worse in this regard, but a significant amount of complexity is very much needful.
  - seanwilson 6y ago
    > Confirm what security though? For PoW, the important property seems to be that there's no shortcut to doing the hard work e.g. I could ask you to sum all the numbers from 1 to N for a very high number of N to prove you've done some work, but the flaw there is that a shortcut exists where where you only have to calculate (n(n+1))/2 to get the final answer in a fraction of the time. > significant amount of complexity is very much needful I think you're using the word complexity in a different way to the way I was using it. I'm guessing you probably mean "is difficult to calculate the result without taking a shortcut" and not "is conceptually simple to understand and analyse for flaws by a human". Ideally, you want both to be true but that won't be the case for all PoW processes.

q3k 6y ago

I also performed analysis of this algorithm as part of a work engagement, and came to similar conclusions to you (that it's not nearly as ASIC resistent as the authors claim). Notably there was (and still somewhat is, but less so [1]) very low data dependency between the generated instructions, which enables ahead-of-time preprocessing on a CPU to get effective execution on a bunch of independent compute units / datapaths (on an FPGA/ASIC), saturating all of them during a significant amount of time. [1] - https://github.com/tevador/RandomX/pull/118 https://github.com/tevador/RandomX/pull/118

hyc_symas 6y ago
So I guess you're referring to section 4.2 in the X41 audit report https://github.com/hyc/RandomxAudits/blob/master/Report-X41-20190705.pdf https://github.com/hyc/RandomxAudits/blob/master/Report-X41-... We already responded to the points you raised. https://github.com/hyc/RandomxAudits/blob/master/Comment-X41.md https://github.com/hyc/RandomxAudits/blob/master/Comment-X41...