Bitcoins are encrypted with SHA-256, and Ethereum is encrypted with SHA3. Why can miners for SHA-256 encryption guess hashes in the TH/s when miners for the SHA3 encryption can only hash in the MH/s? Is the algorithm more complex?

  • Comments are not for extended discussion; this conversation has been moved to chat. – e-sushi Jun 18 '17 at 17:05

I'm not an expert but I'm a good at digging through academic literature, and this is what I found about SHA3 with relevance to FPGAs and ASICS (and in comparison with SHA2).

Note that this paper dates back from 2011, the winner of SHA3 was not yet decided as NIST only released the SHA3 standard in 2015. Take a look at the Keccak result in this paper. The ASIC space, atleast ASICs with the specific purpose of hashing, have evolved a lot the past 6 years and the numbers are probably not up to date.

These graphs (and the corresponding tables) have revealed that Keccak is the only candidate that consistently outperforms SHA-2 for all considered FPGA families and two hash function variants (with 256-bit and 512-bit output).

Another paper, which is also pretty old and dates back to 2010 has indications that Keccak (SHA3) is faster than SHA-256.

Figure 5 illustrates how architecture differences affect the performance results. Some curves, like those of Keccak and Luffa, are very steep. This means that a small increase in area yields a significant performance improvement.

Also, I'm not aware of any ASICs for Ethereum, they are currently being mined using GPU's. As you probably already know: GPU's are magnitudes slower than ASICs thus being in MH/s range is no surprise.

  • 2
    Actually high-bandwidth memory and large memrory amounts are quite expensive and badly parallelizable which is why ETHash is seen as "ASIC unfriendly" whereas CPUs and GPUs have high-perfomance access to large quantities of memory. But anyways, Welcome to Crypto.SE :) – SEJPM Jun 17 '17 at 18:53
  • Why can't someone make an ASIC with a large memory capacity and a high speed bus? – user6086585 Jun 19 '17 at 17:23

Your premise is flawed. I think being good for ASIC was one of the reasons why Keccak won: it was both the fastest and had the best performance/area ratio among the finalists for ASIC reference implementation.

By the way, it's easy to see why it is easier to pipeline in hardware if you consider it uses only simple and/xor/rot/not operations, doing away with that nasty 32-bit adder in SHA-2.

While SHA-3 is indeed slower in software, let's not forget that it was designed to not be susceptible to length extension attacks so single SHA-3 can be used in place of Bitcoin's double SHA-2.


By the way, what's the point in ASIC resistance? "Pool resistance" matters a lot more, and that could be achieved by designing the hashing (not the hash!) in a way that no information can be withhold from the miners, maybe as easily as making the full block the subject of the hash instead of just the head.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.