mczarnek, have you seen
this exchange with Luke-Jr? It may answer some of your questions.
Yes, you can do the same thing with scrypt...
The key part you may be missing in the "shoddily made flow chart" is that it "Does not include caching plot\[s\] to disk and retrieving them." For
$130 plus plotting and optimization time, a 4TB drive can store about 4*(10**12)/(2**18) = 15,258,789 precalculated values corresponding to the boxes in the bottom right-hand corner of the diagram (i.e., "Hash, then hash with the resulting hash, etc.") The other hashes in the mining calculation are fast or only computed once per block, so you can check these 15M values as fast as you can read them off the disk.
Even the
latest bitcoin mining hardware provides at best 5 orders of magnitude speedup over
CPU hashing speeds, so your custom ASIC burning hundreds of watts might just about come within an order of magnitude of the speed achieved with cheap commodity hardware burning less than
10 watts (see figures 11-13).
A custom ASIC for shabal hashes would be super useful for the initial plotting, though.
From the "shoddily made flow chart", this algorithm looks like essentially a more complex and simpler (in different ways) version of scrypt, just with very high memory requirements.
It is probably just as weak to ASICs, though I can't say for sure without more information.
Do actual specifications exist for the algorithm?
Also, is anyone interested in doing a BFGMiner port I can merge?
This algo mines via hdd capacity. Only way an asic would be useful is during the plotting process, but that's not a mining process.
It doesn't have to be a HD, it could just as well be (a lot of) RAM.
This is essentially the same way scrypt works, except scrypt altcoins aren't using as much capacity.
The flowchart is missing the caching and retrieving from disk parts. Since the account id and nonces are run through the repeat hashing step before any network state is used, the results of the repeat hashing can be saved and reused every block, with the miner only having to do the repeat hashing once ever per nonce. This makes it so the computational expense of that initial repeat hashing can be increased any amount without causing miners to do any extra work after the initial caching process. The more expensive that repeat hashing step becomes, the more efficient using pre-cached work is over computing everything on the fly.
Still working on the ASIC resistance. So far, I've got an explanation of why ASIC resistance is important. Sorry it's taking me a while.
(Meant to be read in emacs org-mode. Lines with asterices are headings. More asterices means lower in the heading hierarchy.)
* The ongoing centralization of bitcoin mining
** The role of mining in securing a cryptocurrency
Bitcoin's key innovation in is "mining," a way to encourage people to
make an economic commitment in order to participate in a distributed
consensus about the history of bitcoin transactions. It's essentially a
lottery where you "buy" tickets by running a certain computation. Each
computation generates a lottery ticket and, roughly speaking, if your
ticket has the right number you get to specify the recent transactions
which are appended to the official history in a "block." (The official
history is usually referred to as the "blockchain.") One of these
transactions is usually a reward to yourself, and these rewards are the
financial incentive for mining. If you think of bitcoin as roughly
similar to a credit card system, winning the mining lottery is like
becoming the system's payment processor for a very brief period.
In terms of security, the main benefit of mining is to ensure that it's
very expensive to rewrite a transaction after it goes into the official
record. Very roughly speaking, you would need to generate approximately
the same number of lottery tickets as all mining participants have since
the transaction was recorded. A second benefit is that the process is
massively parallel so in principle many people can participate in it.
This decentralization makes it hard to organize collusive manipulation
of the transaction history.
** Economic incentives to centralize mining
There is a strong incentive to do the mining computations as quickly and
as cheaply as possible: The more lottery tickets ("hashes") you
generate, the more often you get the mining reward. The equipment and
electricity required to generate hashes at a given rate are now about
100,000 times cheaper than they were when bitcoin started. These massive
efficiency gains have mostly been due to the fact that bitcoin initially
ran on commodity CPUs which a huge fraction of people in the developed
world already owned, and now mostly runs on specialized hardware which
is mostly only useful for bitcoin mining, and the fabrication of which
depends on hundreds of thousands of dollars of initial research and
development.
Bitcoin mining thus now requires capital-intensive infrastructure, and
this has predictably led to centralization, i.e. While many were happy
to try out bitcoin in the early days with their spare CPU cycles, far
fewer are prepared to commit $2900 upfront for a mining appliance on the
argument that current conditions suggest they would recoup their outlay
in 100 days or so. Even though ever more capital is committed to
verifying the bitcoin transaction history, it is being concentrated in
the hands of fewer people.
Another factor which has contributed to centralization arises from the
extremely sporadic (though large) minining rewards. For instance, using
the above-mentioned $2900 bitcoin mining appliance, at the time of
writing the expected time between winning the lottery (about a $10,000
payout) is about 11 months, with a 10% probability of taking over 25
months. This high variability in payouts forces a mining operation to
keep a lot of cash on hand for ongoing costs like electricity and loan
repayments. One way to smooth this pay schedule out is to pool efforts
with other miners. With 1000 such miners cooperating, the expected time
to payout is just 8 hours, and a cashflow of $10 roughly every 8 hours
is much easier to manage than $10,000 roughly every 11 months. And of
course the bigger the pool becomes, the lower the variance gets, so big
pools have a competitive advantage just from their size.
This is a powerful centralizing force which has led to the majority of
hashes being generated in the service of just four mining pools at the
time of writing. If the four entities running those pools were to
collude, they could rewrite the transaction history. In June 2014, one
of these pools (GHash.IO) came to control 40% of bitcoin mining power
because it used its size and connections to present a sweeter deal to
miners than other pools could. There were widespread concerns at the
time that the integrity of bitcoin might soon depend on the sheer good
will of GHash. Many GHash miners moved to other pools in order to
prevent that, but in doing so they acted against their own short-term
economic interests, a clear failure of the mining incentive scheme as it
was originally intended, though so far not a catastrophic one.
* Attempts to make mining less capital-intensive
The centralizing force of customized mining hardware ("ASICs") was
widely recognized fairly early, and people attempted to mitigate the
issue by developing memory-intensive mining algorithms which they hoped
would run most efficiently on commodity CPUs. It was hoped that since
with these algorithms most of the computation time is spent keeping track
track of large, mutating data sets, custom hardware would not provide a
significant advantage compared to the memory cache on commodity CPUs.
This has worked to some extent -- for instance, the per-hash cost of
custom hardware for mining LiteCoin (the first cryptocurrency to use
such an algorithm) is only about 100 times lower than mining on a
contemporary CPU. However, the start-up costs necessary to gain this
efficiency are still high enough to motivate intensive centralization --
such a device currently costs $1600, and three pools currently control
more than half the LiteCoin hashing power.
There are also people researching mining algorithms which are so
computationally flexible that specialized hardware just doesn't make
sense for them. SAT...
