<p>I'm not an expert but I'm a good at digging through academic literature, and this is what I found about SHA3 with relevance to FPGAs and ASICS (and in comparison with SHA2).</p>

<hr>

<p>Note that <a href="http://www.ecrypt.eu.org/hash2011/proceedings/hash2011_07.pdf" rel="nofollow noreferrer">this paper</a> dates back from 2011, the winner of SHA3 was not yet decided as NIST only released the SHA3 standard in 2015. Take a look at the Keccak result in this paper. The ASIC space, atleast ASICs with the specific purpose of hashing, have evolved a lot the past 6 years and the numbers are probably not up to date.</p>

<blockquote>
  <p>These  graphs (and  the  corresponding  tables) have revealed that Keccak is the only candidate that consistently outperforms SHA-2 for all considered FPGA families and two hash function variants (with 256-bit and 512-bit output). </p>
</blockquote>

<hr>

<p>Another <a href="http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/papers/SCHAUMONT_SHA3.pdf" rel="nofollow noreferrer">paper</a>, which is also pretty old and dates back to 2010 has indications that Keccak (SHA3) is faster than SHA-256.</p>

<blockquote>
  <p>Figure 5 illustrates how architecture differences affect the performance results. Some curves, like those of Keccak and Luffa, are very steep. This means that a small increase in area yields a significant performance improvement.</p>
</blockquote>

<hr>

<p>Also, I'm not aware of any ASICs for Ethereum, they are currently being mined using GPU's. As you probably already know: GPU's are magnitudes slower than ASICs thus being in MH/s range is no surprise. </p>

CC BY-SA 3.0
2017-06-19T17:23:09.840Z
Why can't someone make an ASIC with a large memory capacity and a high speed bus?
user6086585
CC BY-SA 3.0
2017-06-17T17:52:46.903Z
2017-06-18T16:58:59.117Z
Penquin
<p>Your premise is flawed. I think being good for ASIC was one of the reasons why Keccak won: it was both the fastest and had the best performance/area ratio among the finalists for ASIC reference implementation.</p>

<p>By the way, it's easy to see why it is easier to pipeline in hardware if you consider it uses only simple and/xor/rot/not operations, doing away with that nasty 32-bit adder in SHA-2.</p>

<p>While SHA-3 is indeed slower in software, let's not forget that it was designed to not be susceptible to length extension attacks so single SHA-3 can be used in place of Bitcoin's double SHA-2.</p>

<p>References:</p>

<ul>
<li><a href="http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/papers/SCHAUMONT_SHA3.pdf" rel="nofollow noreferrer">http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/papers/SCHAUMONT_SHA3.pdf</a></li>
<li><a href="https://keccak.team/keccak.noekeon.org/is_sha3_slow.html" rel="nofollow noreferrer">https://keccak.team/keccak.noekeon.org/is_sha3_slow.html</a></li>
</ul>

<p><em>By the way, what's the point in ASIC resistance? "Pool resistance" matters a lot more, and that could be achieved by designing the hashing (not the hash!) in a way that no information can be withhold from the miners, maybe as easily as making the full block the subject of the hash instead of just the head.</em></p>

CC BY-SA 3.0
2017-08-28T09:07:47.740Z
2017-08-28T09:14:07.800Z
2017-08-28T09:14:07.800Z
Tiana
<p>Bitcoins are encrypted with SHA-256, and Ethereum is encrypted with SHA3.  Why can miners for SHA-256 encryption guess hashes in the TH/s when miners for the SHA3 encryption can only hash in the MH/s?  Is the algorithm more complex?</p>

CC BY-SA 3.0
2017-06-18T17:05:13.480Z
Comments are not for extended discussion; this conversation has been [moved to chat](http://chat.stackexchange.com/rooms/60671/discussion-on-question-by-user6086585-why-is-sha3-less-conducive-to-asic).
e-sushi
<mining-theory><asic><asic-resistance>
Why is SHA3 less conducive to ASIC?
user6086585
# Why is SHA3 less conducive to ASIC?

(Asked by: username_0 on 2017-06-17)

Bitcoins are encrypted with SHA-256, and Ethereum is encrypted with SHA3. Why can miners for SHA-256 encryption guess hashes in the TH/s when miners for the SHA3 encryption can only hash in the MH/s? Is the algorithm more complex?

**Tags:** mining-theory, asic, asic-resistance

> **Comments:**
> **username_1**: Comments are not for extended discussion; this conversation has been [moved to chat](http://chat.stackexchange.com/rooms/60671/discussion-on-question-by-username_0-why-is-sha3-less-conducive-to-asic).  

---

## 2 answers

### Answer by username_2 on 2017-06-17. Score: 4

I'm not an expert but I'm a good at digging through academic literature, and this is what I found about SHA3 with relevance to FPGAs and ASICS (and in comparison with SHA2).

---

Note that [this paper](http://www.ecrypt.eu.org/hash2011/proceedings/hash2011_07.pdf) dates back from 2011, the winner of SHA3 was not yet decided as NIST only released the SHA3 standard in 2015. Take a look at the Keccak result in this paper. The ASIC space, atleast ASICs with the specific purpose of hashing, have evolved a lot the past 6 years and the numbers are probably not up to date.

> These graphs (and the corresponding tables) have revealed that Keccak is the only candidate that consistently outperforms SHA-2 for all considered FPGA families and two hash function variants (with 256-bit and 512-bit output).

---

Another [paper](http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/papers/SCHAUMONT_SHA3.pdf), which is also pretty old and dates back to 2010 has indications that Keccak (SHA3) is faster than SHA-256.

> Figure 5 illustrates how architecture differences affect the performance results. Some curves, like those of Keccak and Luffa, are very steep. This means that a small increase in area yields a significant performance improvement.

---

Also, I'm not aware of any ASICs for Ethereum, they are currently being mined using GPU's. As you probably already know: GPU's are magnitudes slower than ASICs thus being in MH/s range is no surprise.

> **Comments:**
> **username_0**: Why can't someone make an ASIC with a large memory capacity and a high speed bus?  

---

### Answer by username_3 on 2017-08-28. Score: 2

Your premise is flawed. I think being good for ASIC was one of the reasons why Keccak won: it was both the fastest and had the best performance/area ratio among the finalists for ASIC reference implementation.

By the way, it's easy to see why it is easier to pipeline in hardware if you consider it uses only simple and/xor/rot/not operations, doing away with that nasty 32-bit adder in SHA-2.

While SHA-3 is indeed slower in software, let's not forget that it was designed to not be susceptible to length extension attacks so single SHA-3 can be used in place of Bitcoin's double SHA-2.

References:

* <http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/papers/SCHAUMONT_SHA3.pdf>
* <https://keccak.team/keccak.noekeon.org/is_sha3_slow.html>

*By the way, what's the point in ASIC resistance? "Pool resistance" matters a lot more, and that could be achieved by designing the hashing (not the hash!) in a way that no information can be withhold from the miners, maybe as easily as making the full block the subject of the hash instead of just the head.*


---

