Memory-hard function: Difference between revisions

Revision as of 20:36, 25 November 2019

Revision as of 20:36, 25 November 2019

Line 9:

== Motivation ==

There is a reason why MHFs cost a lot of memory instead of, say, CPU cycles. Bitcoin used repeated evaluation of SHA function as proof of work, but it turned out that modern general purpose processors, i.e. off-the-shelf CPUs are very inefficient when tasked to compute a fixed function over and over. Miners adopted Application Specific Integrated Circuits, ASICs, and achieveachieved 10^16 speedup. While this is fine for what bitcoin is good for, we want a more "egalitarian" hardness measure. That is, there is no short-cuts like ASICs, we want everyone to be equally inefficient to make sure we don't have to make the function too hard for most CPU users to defend against short-cut takers.

Over time, it has been recognized that memory cost remains fairly equal across the board. Hence MHF.