<p>I should have read the <a href="https://www.internetsociety.org/sites/default/files/blogs-media/equihash-asymmetric-proof-of-work-based-generalized-birthday-problem.pdf" rel="nofollow">Equihash paper</a>.</p>

<p>Basically the PoW is still one big loop going over a 160-bit nonce, but in the body there is the solving of the generalized birthday problem using Wagner's algorithm.</p>

<p>The parameters are pseudorandomly generated (using a hash function based on previous block and nonce) and at the end the solution is again hashed and the number of leading zero bits (of that solution) determines the difficulty. I guess that is why zcashd reports solutions/s and not hashes/s since one solution is one try of a different nonce (and you need a lot of them to get lucky).</p>

<p>SHA256 and Blake2B cryptographic one-way hash functions are still used (I previously thought they weren't), but the speed of calculating them does not dominate mining speed anymore.</p>

CC BY-SA 3.0
2016-10-30T15:19:30.463Z
2016-10-30T15:19:30.463Z
fiction
<p>I found <a href="https://minezcash.com/zcash-mining-pool/" rel="nofollow">https://minezcash.com/zcash-mining-pool/</a> so apparently there are quite a few zcash mining pools already.</p>

<p>Regarding the difficulty question I am currently looking at <a href="https://github.com/str4d/zcash-pow/blob/master/pow.py" rel="nofollow">https://github.com/str4d/zcash-pow/blob/master/pow.py</a> What is irritating me is that there still is a SHA256 calculation apparently.</p>

CC BY-SA 3.0
2016-10-30T13:09:56.027Z
2016-10-30T13:09:56.027Z
fiction
<p>A "sequential memory-hard" PoW scheme cannot be parallelized effectively thus I imagine you also can't distribute solving the puzzle between participants in a pool? How does that work with scrypt then - for instance how do litecoin mining pools work?</p>

<p>Correct me if I am wrong, but equihash is "just" memory-hard. I understand you are solving a generalized birthday problem among randomly generated bitstrings. But my question here is: how does the pool verify you are actually doing meaningful work. Like with a "traditional" PoW you submit partial solutions that don't match the network difficulty but still have some difficulty "attached" that prove you did some work. </p>

<p>For equihash I believe there is no "partial" solution, either you find the inputs that xor to zero or you don't. What am I missing? </p>

<p>Are there any zcash mining pools out there yet? How do they ensure "fairness"?</p>

CC BY-SA 3.0
2016-10-29T19:24:12.543Z
First part of my question can probably be explained: one scrypt calculation is hard to be sped-up using multiple threads, but you can always do multiple of them (with different nonces). Each of them still needs lots of memory. So basically multiple people calculate completely 
different scrypt invocations.

For the second one I probably don't understand how zcash exactly utilizes equihash and I'd be glad if someone can explain that.
fiction
<mining-pools><litecoin><scrypt><zcash>
Is equihash/scrypt suitable for pooled mining?
fiction
# Is equihash/scrypt suitable for pooled mining?

(Asked by: username_0 on 2016-10-29)

A "sequential memory-hard" PoW scheme cannot be parallelized effectively thus I imagine you also can't distribute solving the puzzle between participants in a pool? How does that work with scrypt then - for instance how do litecoin mining pools work?

Correct me if I am wrong, but equihash is "just" memory-hard. I understand you are solving a generalized birthday problem among randomly generated bitstrings. But my question here is: how does the pool verify you are actually doing meaningful work. Like with a "traditional" PoW you submit partial solutions that don't match the network difficulty but still have some difficulty "attached" that prove you did some work.

For equihash I believe there is no "partial" solution, either you find the inputs that xor to zero or you don't. What am I missing?

Are there any zcash mining pools out there yet? How do they ensure "fairness"?

**Tags:** mining-pools, litecoin, scrypt, zcash

> **Comments:**
> **username_0**: First part of my question can probably be explained: one scrypt calculation is hard to be sped-up using multiple threads, but you can always do multiple of them (with different nonces). Each of them still needs lots of memory. So basically multiple people calculate completely  different scrypt invocations.  For the second one I probably don't understand how zcash exactly utilizes equihash and I'd be glad if someone can explain that.  

---

## 2 answers

### Answer by username_0 on 2016-10-30. Score: 1 | Accepted answer

I should have read the [Equihash paper](https://www.internetsociety.org/sites/default/files/blogs-media/equihash-asymmetric-proof-of-work-based-generalized-birthday-problem.pdf).

Basically the PoW is still one big loop going over a 160-bit nonce, but in the body there is the solving of the generalized birthday problem using Wagner's algorithm.

The parameters are pseudorandomly generated (using a hash function based on previous block and nonce) and at the end the solution is again hashed and the number of leading zero bits (of that solution) determines the difficulty. I guess that is why zcashd reports solutions/s and not hashes/s since one solution is one try of a different nonce (and you need a lot of them to get lucky).

SHA256 and Blake2B cryptographic one-way hash functions are still used (I previously thought they weren't), but the speed of calculating them does not dominate mining speed anymore.


---

### Answer by username_0 on 2016-10-30. Score: 0

I found <https://minezcash.com/zcash-mining-pool/> so apparently there are quite a few zcash mining pools already.

Regarding the difficulty question I am currently looking at <https://github.com/str4d/zcash-pow/blob/master/pow.py> What is irritating me is that there still is a SHA256 calculation apparently.


---

