Memory-hard function: Difference between revisions

Revision as of 13:59, 11 December 2019

Revision as of 16:53, 17 December 2019

Line 11:

== Motivation ==

There is a reason why MHFs cost a lot of memory instead of, say, CPU cycles. [[Bitcoin]] used repeated evaluation of [[SHA-2|SHA]] function as proof of work, but it turned out that modern general purpose processors, i.e. off-the-shelf [[Central processing unit|CPU]]<nowiki/>s are very inefficient when tasked to compute a fixed function over and over. Miners adopted [[Application-specific integrated circuit|application-specific integrated circuits]], ASICs, and achieved 10^16 speedup. While this is fine for what bitcoin is good for, we want a more "egalitarian" hardness measure. ThatIn is,other there is no short-cuts like ASICswords, we want everyone to be equally inefficient toin makecomputing surethe wefunction doneven if they have an ASIC. Because if some people can evaluate the function efficiently and some can't, havethen in order to make the function relatively hard for the short-cut takers, we will make the function too hard for mosta CPUregular usersuser. toIf defendeveryone againstis shortinefficient, then everyone can evaluate one moderately-cuthard takersfunction.

Over time, it has been recognized that memory cost remains fairly equal across the board. Hence MHF.