<p>The Scrypt algorithm started out as an "ASIC-resistant" algorithm, but it isn't anymore.</p>

<p>Because it is highly memory-intensive, it was thought to be prohibitive to design and use ASICs for it. Initially it kind of was. With cost of memory decreasing and the necessary research put in -- in order to unlock the profit potential attainable using Scrypt-capable ASICS -- that ASIC-resistance has largely vanished.</p>

<p>A great many ASIC hardware projects for Scrypt started out with great fanfare, but only rather few have succeeded and ever been delivered. A rather large part failed along the way or were scams from the beginning, with developers pocketing money for pre-orders and never delivering any product. Despite these numerous frauds, a number of ASIC development projects have actually been completed and mining hardware has been delivered. As soon as a successfully completed machine was deployed and hit the market, this was always visible in a significant increase in mining difficulty for Scrypt coins whose profitability has, as a result, steadily decreased with every new ASIC model delivered.</p>

<p>The only residues of Scrypt being ASIC-resistant these days are the lower hash rates you see with Scrypt-based Crypto coins as opposed to SHA-256 ones.</p>

CC BY-SA 3.0
2017-02-11T18:12:07.670Z
Litecoin was never ASIC resistant - see http://bitcoin.stackexchange.com/questions/36642/why-did-litecoin-choose-the-scrypt-factors-that-they-did/36644#36644
Nick ODell
CC BY-SA 3.0
2017-05-12T19:01:45.670Z
Scrypt was designed to be (or at least claimed to be) GPU resistant. When it failed at that, it got rebranded as ASIC-resistant (but fails at that too).
Pieter Wuille
CC BY-SA 4.0
2018-12-24T23:11:01.420Z
yes, I know -- hence the quotation marks, indicated that that's what people initially said about the algorithm.
marquix
CC BY-SA 3.0
2017-02-11T16:44:20.883Z
2017-02-11T16:52:24.523Z
2017-02-11T16:52:24.523Z
marquix
<p><a href="https://en.wikipedia.org/wiki/Scrypt" rel="nofollow">Scrypt</a> is a highly memory-intensive algorithm: it generates and uses a very large number of pseudo-random values in computing the final output, and for efficiency reasons, all of these intermediate values need to be stored until the computation is done.</p>

<p>The cost of an ASIC depends roughly on the physical size of the chip, and memory circuits take up a great deal of space.  A memory-light function like Bitcoin's SHA-256 requires a small circuit, so you can fit thousands of computation units on a reasonably-priced chip.  A similarly-priced Litecoin ASIC, on the other hand, might only be able to fit one or two computation units on the chip.</p>

CC BY-SA 3.0
2016-10-26T03:04:48.367Z
Then how do you explain that Litecoin ASICs had a larger speed boost over GPU mining then Bitcoin ASICs had over GPUs?
Pieter Wuille
CC BY-SA 3.0
2016-10-29T12:52:49.533Z
Scrypt is not memory hard, it has [trivial time memory tradeoffs](https://eprint.iacr.org/2015/227.pdf) which *all* scrypt ASICs implement, allowing you to use almost no memory with a linear increase in time.
Claris
CC BY-SA 3.0
2016-10-26T02:17:50.997Z
2016-10-26T02:17:50.997Z
Mark
<p>I just started reading about Litecoin's Scrypt algorithm and all the explanations are quite complex. I have understood that Scrypt uses more memory than Bitcoin's SHA-256 which makes it ASIC-resistant and prevents centralization. </p>

<p>But, from what I understand we still require powerful GPUs to mine Litecoins because operations on larger data sets (more memory) will be faster and more efficient in GPU than in CPU. </p>

<p>Also, why is it not possible to build an ASIC machine for Scrypt. Is it due to the complexity involved in the algorithm? I just want to know if it's impossible or just difficult. In the future, can we expect ASIC machines for Scrypt as well?</p>

CC BY-SA 3.0
2016-10-26T02:35:35.107Z
I don't have personal experience here, but a quick Google suggests that Scrypt ASICs have been on the market for a couple years now.
Nate Eldredge
<litecoin><scrypt><asic-resistance>
How is Scrypt ASIC-resistant?
galahad
# How is Scrypt ASIC-resistant?

(Asked by: username_0 on 2016-10-26)

I just started reading about Litecoin's Scrypt algorithm and all the explanations are quite complex. I have understood that Scrypt uses more memory than Bitcoin's SHA-256 which makes it ASIC-resistant and prevents centralization.

But, from what I understand we still require powerful GPUs to mine Litecoins because operations on larger data sets (more memory) will be faster and more efficient in GPU than in CPU.

Also, why is it not possible to build an ASIC machine for Scrypt. Is it due to the complexity involved in the algorithm? I just want to know if it's impossible or just difficult. In the future, can we expect ASIC machines for Scrypt as well?

**Tags:** litecoin, scrypt, asic-resistance

> **Comments:**
> **username_1**: I don't have personal experience here, but a quick Google suggests that Scrypt ASICs have been on the market for a couple years now.  

---

## 2 answers

### Answer by username_2 on 2017-02-11. Score: 3

The Scrypt algorithm started out as an "ASIC-resistant" algorithm, but it isn't anymore.

Because it is highly memory-intensive, it was thought to be prohibitive to design and use ASICs for it. Initially it kind of was. With cost of memory decreasing and the necessary research put in -- in order to unlock the profit potential attainable using Scrypt-capable ASICS -- that ASIC-resistance has largely vanished.

A great many ASIC hardware projects for Scrypt started out with great fanfare, but only rather few have succeeded and ever been delivered. A rather large part failed along the way or were scams from the beginning, with developers pocketing money for pre-orders and never delivering any product. Despite these numerous frauds, a number of ASIC development projects have actually been completed and mining hardware has been delivered. As soon as a successfully completed machine was deployed and hit the market, this was always visible in a significant increase in mining difficulty for Scrypt coins whose profitability has, as a result, steadily decreased with every new ASIC model delivered.

The only residues of Scrypt being ASIC-resistant these days are the lower hash rates you see with Scrypt-based Crypto coins as opposed to SHA-256 ones.

> **Comments:**
> **username_3**: Litecoin was never ASIC resistant - see http://bitcoin.stackexchange.com/questions/36642/why-did-litecoin-choose-the-scrypt-factors-that-they-did/36644#36644  
> **username_4**: Scrypt was designed to be (or at least claimed to be) GPU resistant. When it failed at that, it got rebranded as ASIC-resistant (but fails at that too).  
> **username_2**: yes, I know -- hence the quotation marks, indicated that that's what people initially said about the algorithm.  

---

### Answer by username_5 on 2016-10-26. Score: 1

[Scrypt](https://en.wikipedia.org/wiki/Scrypt) is a highly memory-intensive algorithm: it generates and uses a very large number of pseudo-random values in computing the final output, and for efficiency reasons, all of these intermediate values need to be stored until the computation is done.

The cost of an ASIC depends roughly on the physical size of the chip, and memory circuits take up a great deal of space. A memory-light function like Bitcoin's SHA-256 requires a small circuit, so you can fit thousands of computation units on a reasonably-priced chip. A similarly-priced Litecoin ASIC, on the other hand, might only be able to fit one or two computation units on the chip.

> **Comments:**
> **username_4**: Then how do you explain that Litecoin ASICs had a larger speed boost over GPU mining then Bitcoin ASICs had over GPUs?  
> **username_6**: Scrypt is not memory hard, it has [trivial time memory tradeoffs](https://eprint.iacr.org/2015/227.pdf) which *all* scrypt ASICs implement, allowing you to use almost no memory with a linear increase in time.  

---

