The mining algorithm for Bitcoins (and most alternative but similar currencies as well) is purely computation hard, but not decision hard or memory hard. This caused the unexpected effect that GPUs are insanely good at mining and CPUs are so bad at mining that there's almost no point in using them to mine.

This has had many effects, including the concentration of mining into specialized hardware. Suppose that I think that's bad and would prefer that commodity CPUs be optimal for mining and that mining on them be practical. Given the requirements of mining, particularly that it work like a lottery and that valid results be quickly verifiable, are there algorithms that could have been chosen that would have resulted in commodity CPUs being the optimal miners?

Are there algorithms that require lots of decisions and/or lots of memory that could serve as the mining algorithm on future crypto-currencies that would make CPU mining practical again and give everyone with a high-end CPU a reasonable chance at mining?

  • 1
    Interesting idea. However, even if there was an algorithm that favored commodity hardware it would still not put mining back into the hands of the people because of bot-networks. Maybe there needs to be an additional requirement of human input, like a CAPTCHA. – Thilo Sep 13 '11 at 1:13
  • 4
    @Thilo Can you imagine the tedium of endlessly answering CAPTCHA questions to keep a currency operational? <Shudder> – Gary Rowe Sep 13 '11 at 9:36
  • 1
    I don't think a computer can easily verify a CAPTCHA it didn't generate, so that wouldn't work. Good point about botnets though, that's a serious problem. – David Schwartz Sep 13 '11 at 16:21
  • What would be even better would be some sort of algorithm that didn't require upper end hardware of any sort, and used less electricity to run. I can't imagine how that could work though - even if you based chances of solving a block on something like the combo of the current time and your IP address, you'd still get an advantage by using lots of IP addresses (and it would also result in stacks of low value hardware participating, instead of a lesser amount of high value hardware). Finding some sort of activity to perform that benefits people at the same time would be the ultimate achievement. – Highly Irregular Oct 3 '11 at 21:28
  • 2
    You can't really repurpose a botnet or a supercomputer to attack an ASIC-friendly crypo-currency -- you pretty much have to invest in ASICS, and thus in the very crypto-currency you're attacking. That's why Bitcoin got it right. – David Schwartz Jun 3 '13 at 19:26

The scrypt key derivation function was explicitly designed to be resistant to hardware optimization, with an explicit trade-off allowed between memory and cpu usage:

The scrypt key derivation function ... is designed to be far more secure against hardware brute-force attacks than alternative functions such as PBKDF2 or bcrypt.

This makes it better than SHA-256 or bcrypt if the intent is to give more of an advantage to CPUs.

Another option would be to include the same sort of variety of primitives that are provided for general purpose CPUs, e.g. a combination of floating point operations, access to large memories (perhaps including something that would use a large random access memory like a disk), etc.

But as Thilo point out, including some sort of anti-botnet feature might also be needed. A CAPTCHA might also make it rather unpopular, but some sort of work load that would indeed be noticed by a regular computer user might make it hard to hide botnet activity.

| improve this answer | |
  • Tenebrix is AFAIK the first crypto currency relying on CPU-friendly algorithms (specifically scrypt if I'm not mistaken). tenebrix.org Note there are some serious caveats with Tenebrix: bitcointalk.org/index.php?topic=47269.0 – ripper234 Oct 9 '11 at 7:06
  • I think using a very large amount store would be interesting to explore. It would be very noticeable to a user, as "disk space left" is just about the only statistic they get. If that size is deduced from something difficult like the (high) primes it can be enlarged and shrunk as needed by the network. Interesting idea. – Lodewijk Apr 16 '12 at 21:48

I suggest bcrypt. It is not a cryptographic hash function per se, but it could replace SHA-256 and add some memory constraints that would make its implementation harder on GPUs.

Bcrypt uses blowfish to encrypt a string with a key derived from a password chosen by the user. So given a string and a target, finding a password that encrypts the string below the target works exactly like the Bitcoin lottery.
As for the memory constraints, it is possible to implement bcrypt on a GPU, but it is much harder (probably impossible) to get the same kind of performance improvements we see with SHA. Here is an excerpt from a post on crypto stackexchange about implementing bcrypt with cuda:


| improve this answer | |

The choice of the SHA-256 algorithm for Bitcoin's proof of work has created what could be described as the most ideal application for botnets that one could possibly conceive of. Bot masters are looking for ways, essentially, to turn computation into cash. Bitcoin does that natively.

The huge risk is if the botnets take over the network. Given that botnets can comprise up to millions of machines (at their largest - most are much smaller than this), even with CPU mining a single botnet could potentially take over the network. For instance, assume a 2M strong botnet comprising Core2 Duo machines (5 MHash/s). This network would do 10 THash/s.

The only countermeasure to this is to have special mining gear that is more efficient than CPUs and GPUs, and not available on the average botted PC. This is why the community needs an ASIC-based mining solution.

| improve this answer | |
  • 1
    Sure, if you assume someone makes the ASICs available to all rather than keeping them to themselves. – David Schwartz Sep 14 '11 at 0:05
  • 2
    There is no 2 million strong botnet. Anywhere. Storm Trojan is the largest known botnet and it has 250K nodes. The second largest botnet has a mere 30K nodes. SHA-256 is the algorithm that is used and to say it is "ideal application" for botnets is silly. The very fact that GPU can efficiently accelerate SHA-256 is what gives bitcoin a chance against botnets. Since 1 high end GPU can equal 200+ CPU it gives the "valid nodes" a multiplier effect. Even if your unrealistic example 10TH botnet wouldn't have sufficient capacity to break bitcoin. – DeathAndTaxes Oct 5 '11 at 5:33
  • @DeathAndTaxes How do you know the size of various bot nets? – goodguys_activate Sep 12 '12 at 19:48

Your Answer

