phc-discussions - Re: [PHC] [OT] Improvement to Momentum PoW

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAOLP8p67BvMcRveV0_duck189TLhcBRPxW32cjsiuZ7hwZmS6A@mail.gmail.com>
Date: Tue, 28 Jul 2015 10:39:07 -0700
From: Bill Cox <waywardgeek@...il.com>
To: "discussions@...sword-hashing.net" <discussions@...sword-hashing.net>, John Tromp <john.tromp@...il.com>
Subject: Re: [PHC] [OT] Improvement to Momentum PoW

Here's a great link to radix-sort on GPUs
<https://code.google.com/p/back40computing/wiki/RadixSorting>.  These guys
can radix-sort 1 billion 32-bit hashes per second on a $100 GPU (GTX 480).
After that, finding collisions is a linear pass, and can be done massively
in parallel at full memory bandwidth.  This is much faster than what my CPU
seems capable of.  This $100 GPU has around 133 GiB/s bandwidth to memory.
With 4 read/write passes of 4 GiB for radix-sort, that's 32 GiB/s.  Not too
bad.

This GPU seems to be an outstanding value in terms of bandwidth/$.  While
CPU bound PoW is possible (as I described on another thread), This version
of Momentum seems like a better fit for GPUs than CPUs.  GPUs can also do
the collision threshold check massively in parallel.  This seems closer to
ASIC resistant to me, though the power is likely going to dominate the
cost.  An ASIC would eliminate most of the power burned by the GPU chip,
but would not reduce the GDDR memory read/write power.

The ASIC defense when running Momentum in this mode should be higher than
the current Momentum mining algorithms, as this radix-sort is using a far
higher portion of the GDDR memory bandwidth.  It relies far less on
cache-miss latency, and memory reduction algorithms are more constrained.

Bill

Content of type "text/html" skipped