The mining algorithm for Bitcoins (and most alternative but similar currencies as well) is purely computation hard, but not decision hard or memory hard. This caused the unexpected effect that GPUs are insanely good at mining and CPUs are so bad at mining that there's almost no point in using them to mine.

This has had many effects, including the concentration of mining into specialized hardware. Suppose that I think that's bad and would prefer that commodity CPUs be optimal for mining and that mining on them be practical. Given the requirements of mining, particularly that it work like a lottery and that valid results be quickly verifiable, are there algorithms that could have been chosen that would have resulted in commodity CPUs being the optimal miners?

Are there algorithms that require lots of decisions and/or lots of memory that could serve as the mining algorithm on future crypto-currencies that would make CPU mining practical again and give everyone with a high-end CPU a reasonable chance at mining?

  • 1
    Interesting idea. However, even if there was an algorithm that favored commodity hardware it would still not put mining back into the hands of the people because of bot-networks. Maybe there needs to be an additional requirement of human input, like a CAPTCHA.
    – Thilo
    Commented Sep 13, 2011 at 1:13
  • 4
    @Thilo Can you imagine the tedium of endlessly answering CAPTCHA questions to keep a currency operational? <Shudder>
    – Gary
    Commented Sep 13, 2011 at 9:36
  • 1
    I don't think a computer can easily verify a CAPTCHA it didn't generate, so that wouldn't work. Good point about botnets though, that's a serious problem. Commented Sep 13, 2011 at 16:21
  • What would be even better would be some sort of algorithm that didn't require upper end hardware of any sort, and used less electricity to run. I can't imagine how that could work though - even if you based chances of solving a block on something like the combo of the current time and your IP address, you'd still get an advantage by using lots of IP addresses (and it would also result in stacks of low value hardware participating, instead of a lesser amount of high value hardware). Finding some sort of activity to perform that benefits people at the same time would be the ultimate achievement. Commented Oct 3, 2011 at 21:28
  • 2
    You can't really repurpose a botnet or a supercomputer to attack an ASIC-friendly crypo-currency -- you pretty much have to invest in ASICS, and thus in the very crypto-currency you're attacking. That's why Bitcoin got it right. Commented Jun 3, 2013 at 19:26

3 Answers 3


The scrypt key derivation function was explicitly designed to be resistant to hardware optimization, with an explicit trade-off allowed between memory and cpu usage:

The scrypt key derivation function ... is designed to be far more secure against hardware brute-force attacks than alternative functions such as PBKDF2 or bcrypt.

This makes it better than SHA-256 or bcrypt if the intent is to give more of an advantage to CPUs.

Another option would be to include the same sort of variety of primitives that are provided for general purpose CPUs, e.g. a combination of floating point operations, access to large memories (perhaps including something that would use a large random access memory like a disk), etc.

But as Thilo point out, including some sort of anti-botnet feature might also be needed. A CAPTCHA might also make it rather unpopular, but some sort of work load that would indeed be noticed by a regular computer user might make it hard to hide botnet activity.

  • Tenebrix is AFAIK the first crypto currency relying on CPU-friendly algorithms (specifically scrypt if I'm not mistaken). tenebrix.org Note there are some serious caveats with Tenebrix: bitcointalk.org/index.php?topic=47269.0
    – ripper234
    Commented Oct 9, 2011 at 7:06
  • I think using a very large amount store would be interesting to explore. It would be very noticeable to a user, as "disk space left" is just about the only statistic they get. If that size is deduced from something difficult like the (high) primes it can be enlarged and shrunk as needed by the network. Interesting idea.
    – Lodewijk
    Commented Apr 16, 2012 at 21:48

I suggest bcrypt. It is not a cryptographic hash function per se, but it could replace SHA-256 and add some memory constraints that would make its implementation harder on GPUs.

Bcrypt uses blowfish to encrypt a string with a key derived from a password chosen by the user. So given a string and a target, finding a password that encrypts the string below the target works exactly like the Bitcoin lottery.
As for the memory constraints, it is possible to implement bcrypt on a GPU, but it is much harder (probably impossible) to get the same kind of performance improvements we see with SHA. Here is an excerpt from a post on crypto stackexchange about implementing bcrypt with cuda:

Now bcrypt is a variant of the Blowfish key scheduling, which is defined over a table (a few kilobytes) which is constantly accessed and modified throughout the algorithm. Due to the size of the table, each core will have to store it in the GPU main RAM, and they will compete for usage of the memory bus. So bcrypt will run -- but not with full parallelism. At any time, most cores will be stalled, waiting for the memory bus to become free.


The choice of the SHA-256 algorithm for Bitcoin's proof of work has created what could be described as the most ideal application for botnets that one could possibly conceive of. Bot masters are looking for ways, essentially, to turn computation into cash. Bitcoin does that natively.

The huge risk is if the botnets take over the network. Given that botnets can comprise up to millions of machines (at their largest - most are much smaller than this), even with CPU mining a single botnet could potentially take over the network. For instance, assume a 2M strong botnet comprising Core2 Duo machines (5 MHash/s). This network would do 10 THash/s.

The only countermeasure to this is to have special mining gear that is more efficient than CPUs and GPUs, and not available on the average botted PC. This is why the community needs an ASIC-based mining solution.

  • 1
    Sure, if you assume someone makes the ASICs available to all rather than keeping them to themselves. Commented Sep 14, 2011 at 0:05
  • 2
    There is no 2 million strong botnet. Anywhere. Storm Trojan is the largest known botnet and it has 250K nodes. The second largest botnet has a mere 30K nodes. SHA-256 is the algorithm that is used and to say it is "ideal application" for botnets is silly. The very fact that GPU can efficiently accelerate SHA-256 is what gives bitcoin a chance against botnets. Since 1 high end GPU can equal 200+ CPU it gives the "valid nodes" a multiplier effect. Even if your unrealistic example 10TH botnet wouldn't have sufficient capacity to break bitcoin. Commented Oct 5, 2011 at 5:33
  • @DeathAndTaxes How do you know the size of various bot nets? Commented Sep 12, 2012 at 19:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.