5 ms·

The scrypt used in cryptocoins has been sabotaged by limiting the amount of RAM it uses.

• tromp 12y ago
  That sabotage was "necessitated" by the desire for fast proof-of-work verification. With hashcash, proof attempt is as hard as proof verification, but there are other asymmetric schemes where the former is much harder. The first such PoW was primecoin. My own design Cuckoo Cycle is another, that aims to be the most memory bound of all PoWs.
  • cperciva 12y ago
    > That sabotage was "necessitated" by the desire for fast proof-of-work verification. Oh, I understand why they did it. But it still removed the most important property of scrypt. We wouldn't have scrypt ASICs if that change hadn't been made.
• SwellJoe 12y ago
  But, even sabotaged in that way, ASICs still aren't able to compromise keys, right? (Just as ASICs for SHA256 don't compromise Bitcoin keys.) I'm not suggesting this clarification isn't useful, but I was replying to someone claiming that scrypt is effectively broken because there are ASICs for computing scrypt hashes, which according to my understand is not correct.
  • cperciva 12y ago
    There is no hard line for "broken" when you're talking about password hashing. The availability of ASICs brings the cost per hash down significantly though. (If it didn't, nobody would bother designing ASICs.)