<p>Let me describe when a hash function can (not) be calculated efficiently by using ASICs or GPUs:</p>

<p><strong>ASICs:</strong> I'm speaking of simple in design, cheap ASICs, because in theory you can design an ASIC for every digital function. Simple ASICs are mostly designed for linear workflows. So they do not use loops (or loops with a hardcoded count), no recursion and a very limited memory requirements and local memory access (payload size is known). So the designer has to know the exact digital formulas. Imagine them as a calculator for mathematics terms (no jumps, every input/output as variable).</p>

<p><strong>GPUs:</strong> They are good when it comes to small functions which are executed very often and having medium memory usage. Recursion doesn't work very well and complex, non-parallelized functions aren't handled in an efficient way.</p>

<p>So if you want to design a hash function that doesn't work well on either of them, use a complex function with high random memory access. Also make sure that the hash function does not contain parallel small parts (good for GPUs). Use data dependencies to ensure this. Please consider that it is always possible to build better more expensive ASICs for every function. So it's about <em>cheap ASIC development</em> VS <em>complexity of the hash function</em>.</p>

<p>Explanation of some used therms:</p>

<ul>
<li>Complexity: doesn't mean <a href="https://en.wikipedia.org/wiki/Big_O_notation" rel="nofollow noreferrer">theoretical complexity</a> Here it's about the length of the description, the number of function calls / jumps and dynamic behavior (non hardcoded loop counts / memory requirements)</li>
<li>Recursion: a function calls itself one or multiple times, so a stack structure is required.</li>
<li>Data dependency: To calculate the next subresult (e.g. when using loops), you need the previous subresult (e.g. from the last loop body execution).</li>
</ul>

CC BY-SA 3.0
2013-07-12T13:54:58.793Z
2017-03-01T12:12:45.890Z
2017-03-01T12:12:45.890Z
Marco Neumann
<p>It would be a bad idea. Two huge problems kill this idea:</p>

<ol>
<li><p>So long as it is very profitable to mine the currency, people will set up optimized operations to mine the currency. This will increase until it is no longer very profitable to mine the currency. Your general-purpose hardware isn't optimized for anything -- it's virtually impossible to find a task that a committed miner couldn't find better hardware for, lower electricity prices, or some other competitive edge. Without a competitive edge, you'd be mining at a loss.</p></li>
<li><p>Such a currency would be insecure. Anyone who wanted to attack the currency could rent CPU power, retask a botnet, or the like. In contrast, ASICs require a significant investment in the currency and can't be used for anything else, making attacks much more difficult and expensive.</p></li>
</ol>

CC BY-SA 3.0
2013-07-13T05:47:06.090Z
But wouldn't CPU-only mining lead to many more miners due to the more widely available entry-level, thus deterring centralization & increasing security instead?
Griffin
CC BY-SA 3.0
2013-07-13T20:00:22.757Z
It would lead to many more miners, but that wouldn't have any significant affect because those miners would each be adding so very little hashing power. It would still be dominated by the guys who put specialized hardware (maximum CPU power for minimum cost) wherever the power is cheapest. The downside of being able to attack the currency with a botnet or rented clusters would completely outweigh that miniscule benefit.
David Schwartz
CC BY-SA 3.0
2013-07-13T01:52:46.027Z
2013-07-13T01:52:46.027Z
David Schwartz
<p>Greed will always make it so that Determined individuals will do whatever they can to milk this situation - you will never be able to create a currency that "pads against those who desire to profit"  </p>

<p>Even if BTC dies in flames and we all have asics Hardware - there will be an active market of users who adopt a different sha-256 standard.  The reason so many scrypt alt coins exist is because FUD - Greedy Devs think that users like you "want CPU" viable coin and will go through the efforts of Copy/Pasting to create a "new" alt-chain type of coin.  </p>

<p>As we now see, there are over 50 varieties of Alt-Coin...how come the vast majority of alts are all Scrypt?</p>

CC BY-SA 3.0
2013-07-17T09:47:43.850Z
How come the vast majority of alts are all Scrypt? - I think that's because it's easy to clone the source code of alt coin, and Scrypt is more attractive now that Asics are mining the sha-256 bitcoins.
kristianp
CC BY-SA 3.0
2013-07-16T23:19:58.357Z
2013-07-16T23:19:58.357Z
Frankenmint
<p>Or perhaps scrypt is closer to Satoshi's vision of truly decentralised crypto currency whose whole validation and monetary reward is headed towards a situation identical to the current banking system whereby the haves are in control whilst the havenots ate powerless. 
Whilst ASICs are starting to obey Moore's Law it's a far cry from being decentralised when you consider btc pools like BTC GUILD account for 47% of mining power (as if that figure isn't over 51%!) </p>

CC BY-SA 3.0
2014-01-01T16:52:58.147Z
2014-01-01T16:52:58.147Z
user10268
<p>I have been reading about the LiteCoin, and how it uses a hashing function (scrypt) that is not able to be mined by ASICs.  As a side-effect of this, it has been said that people with GPUs will move to Litecoin, as the ASICs take over bitcoin mining.  I'm wondering, are there any hashing functions that are resistant to GPUs as well as ASICs?  It would be nice to have a crypto-currency based on those, so I could use my CPU to do mining, without having to buy an expensive graphics card to keep up.</p>

<mining-hardware>
What's next after scrypt?
kristianp
# What's next after scrypt?

(Asked by: username_0 on 2013-07-12)

I have been reading about the LiteCoin, and how it uses a hashing function (scrypt) that is not able to be mined by ASICs. As a side-effect of this, it has been said that people with GPUs will move to Litecoin, as the ASICs take over bitcoin mining. I'm wondering, are there any hashing functions that are resistant to GPUs as well as ASICs? It would be nice to have a crypto-currency based on those, so I could use my CPU to do mining, without having to buy an expensive graphics card to keep up.

**Tags:** mining-hardware


---

## 4 answers

### Answer by username_1 on 2013-07-12. Score: 7

Let me describe when a hash function can (not) be calculated efficiently by using ASICs or GPUs:

**ASICs:** I'm speaking of simple in design, cheap ASICs, because in theory you can design an ASIC for every digital function. Simple ASICs are mostly designed for linear workflows. So they do not use loops (or loops with a hardcoded count), no recursion and a very limited memory requirements and local memory access (payload size is known). So the designer has to know the exact digital formulas. Imagine them as a calculator for mathematics terms (no jumps, every input/output as variable).

**GPUs:** They are good when it comes to small functions which are executed very often and having medium memory usage. Recursion doesn't work very well and complex, non-parallelized functions aren't handled in an efficient way.

So if you want to design a hash function that doesn't work well on either of them, use a complex function with high random memory access. Also make sure that the hash function does not contain parallel small parts (good for GPUs). Use data dependencies to ensure this. Please consider that it is always possible to build better more expensive ASICs for every function. So it's about *cheap ASIC development* VS *complexity of the hash function*.

Explanation of some used therms:

* Complexity: doesn't mean [theoretical complexity](https://en.wikipedia.org/wiki/Big_O_notation) Here it's about the length of the description, the number of function calls / jumps and dynamic behavior (non hardcoded loop counts / memory requirements)
* Recursion: a function calls itself one or multiple times, so a stack structure is required.
* Data dependency: To calculate the next subresult (e.g. when using loops), you need the previous subresult (e.g. from the last loop body execution).


---

### Answer by username_2 on 2013-07-13. Score: 2

It would be a bad idea. Two huge problems kill this idea:

1. So long as it is very profitable to mine the currency, people will set up optimized operations to mine the currency. This will increase until it is no longer very profitable to mine the currency. Your general-purpose hardware isn't optimized for anything -- it's virtually impossible to find a task that a committed miner couldn't find better hardware for, lower electricity prices, or some other competitive edge. Without a competitive edge, you'd be mining at a loss.
2. Such a currency would be insecure. Anyone who wanted to attack the currency could rent CPU power, retask a botnet, or the like. In contrast, ASICs require a significant investment in the currency and can't be used for anything else, making attacks much more difficult and expensive.

> **Comments:**
> **username_3**: But wouldn't CPU-only mining lead to many more miners due to the more widely available entry-level, thus deterring centralization & increasing security instead?  
> **username_2**: It would lead to many more miners, but that wouldn't have any significant affect because those miners would each be adding so very little hashing power. It would still be dominated by the guys who put specialized hardware (maximum CPU power for minimum cost) wherever the power is cheapest. The downside of being able to attack the currency with a botnet or rented clusters would completely outweigh that miniscule benefit.  

---

### Answer by username_4 on 2013-07-16. Score: 0

Greed will always make it so that Determined individuals will do whatever they can to milk this situation - you will never be able to create a currency that "pads against those who desire to profit"

Even if BTC dies in flames and we all have asics Hardware - there will be an active market of users who adopt a different sha-256 standard. The reason so many scrypt alt coins exist is because FUD - Greedy Devs think that users like you "want CPU" viable coin and will go through the efforts of Copy/Pasting to create a "new" alt-chain type of coin.

As we now see, there are over 50 varieties of Alt-Coin...how come the vast majority of alts are all Scrypt?

> **Comments:**
> **username_0**: How come the vast majority of alts are all Scrypt? - I think that's because it's easy to clone the source code of alt coin, and Scrypt is more attractive now that Asics are mining the sha-256 bitcoins.  

---

### Answer by username_5 on 2014-01-01. Score: 0

Or perhaps scrypt is closer to Satoshi's vision of truly decentralised crypto currency whose whole validation and monetary reward is headed towards a situation identical to the current banking system whereby the haves are in control whilst the havenots ate powerless.
Whilst ASICs are starting to obey Moore's Law it's a far cry from being decentralised when you consider btc pools like BTC GUILD account for 47% of mining power (as if that figure isn't over 51%!)


---

