Equihash is a memory-hard Proof-of-work algorithm introduced by the University of Luxembourg's Interdisciplinary Centre for Security, Reliability and Trust (SnT) at the 2016 Network and Distributed System Security Symposium. The algorithm is based on a generalization of the Birthday problem which finds colliding hash values. It has severe time-space trade-offs but concedes vulnerability to unforeseen parallel optimizations.[1] It was designed such that parallel implementations are bottle-necked by memory bandwidth in an attempt to worsen the cost-performance trade-offs of designing custom ASIC implementations. ASIC resistance in Equihash is based on the assumption that commercially-sold hardware already has quite high memory bandwidth, so improvements made by custom hardware may not be worth the development cost.
Equihash was proposed by Alex Biryukov and Dmitry Khovratovich as part of the University of Luxembourg research group CryptoLUX. It was introduced at the Network and Distributed System Security Symposium 2016 in San Diego. Notable blockchain-based projects such as ZCash, BitcoinZ, Horizen, Aion, Hush, and Pirate Chain have integrated Equihash for reasons such as security, privacy, and ASIC miner resistance.
The manufacturer Bitmain has succeeded in optimizing the processing of Zcash's Equihash-200,9 with an ASIC.[2]
Equihash has three parameters –
n
k
d
| |||||
2 |
| ||||
2 |
d=0
The problem in Equihash is to find distinct,
n
i1,i2,...,
i | |
2k |
H(i1) ⊕ H(i2) ⊕ ... ⊕
H(i | |
2k |
)=0
H(i1\paralleli2\parallel...\parallel
i | |
2k |
)
d
H
2k
It is proposed that the puzzle in Equihash be solved by a variation of Wagner's algorithm for the generalized birthday problem. (Note that the underlying problem is not exactly the Generalized Birthday Problem as defined by Wagner, since it uses a single list rather than multiple lists.) The proposed algorithm makes
k
1 | |
q |
| ||||
q |
The cryptocurrency Zcash implements Equihash with
n=200
k=9
The cryptocurrency BitcoinGold implements Equihash with
n=144
k=5