Taken from ASICs and Decentralization FAQ by Andrew Poelstra:

Are ASIC’s evil?

No, dedicated hardware brings us closer to the thermodynamic limit, and is therefore eventu- ally a good thing for mining decentralization. Also, because ASIC’s produce more hashes for the same amount of energy, they produce stronger proofs-of-work with proportionally less environmental impact.

However, ASIC’s bring with them a risk of manufacturer centralization, such as what we saw with Bitcoin in the early days of ASIC mining. Market forces eventually broke this monopoly and one thing which sped up the process is that Bitcoin uses the SHA2 hasing algorithm, which was designed for easy development of dedicated hardware.

Therefore, relatively little startup capital is needed to develop Bitcoin ASIC’s. Further, regardless of one’s personal feeling toward ASIC’s, they are inevitable. Dedicated hardware will always be more efficient than general-purpose hardware (exactly because it is closer to the thermodynamic limit) and Bitcoin’s incentives are aligned for ever-increasing efficiency.

Is ASIC resistance desirable?

No. ASIC resistance typically involves increasing algorithmic complexity to discourage ASIC developers. However, ASIC’s are still inevitable; all ASIC resistance does is increase the startup capital required and therefore increase centralization of manufacturing. Further, increasing the complexity of proof generation often means also increasing the com- plexity of proof validation, often disproportionately slow. This discourages (unpaid) non- mining validators, which also increases centralization.

Is ASIC resistance possible?

ASIC resistance, in the sense of making life difficult for ASIC manufacturers (and therefore reducing the number of distinct manufacturers) is possible. But it is impossible to create an algorithm which runs at the same speed on general-purpose and dedicated hardware (since general-purpose hardware contains many extraneous features, e.g. communication buses for peripherals), and so ultimately ASIC resistance is futile.

(Schemes such as “the developers will just change the proof-of-work algorithm if ASIC’s appear” do not even make sense — in a decentralized currency the developers have no such power, while in a centralized currency proof-of-work is a completely unnecessary waste of power.)

Is memory hardness desirable?

No. Memory hardness has the effect of increasing ASIC board footprint, weakening the heat- dissipation decentralization provided by the thermodynamic limit. Further, it increases the capital costs of mining equipment relative to the energy costs, which also encourages cen- tralization (since established miners have amortized their equipment more than new miners). These effects are amplified by the fact that SRAM is both several times faster and several times more expensive than DRAM.

Also, memory hard proofs-of-work often require lots of memory on the part of the verifiers which is bad for decentralization as already discussed.

As an aside, since memory is far away and expensive to access on general purpose computers, memory hardness actually increases the benefit provided by ASIC’s! This is contrary to the goals of most memory-hard advocates, and as we have seen above, memory-hardness worsens the centralizing effects of ASIC’s while weakening the decentralizing effects.

One more thing worth mentioning is time-memory tradeoff (TMTO). This is a property of an algorithm which allows higher memory usage to be traded for a heavier computational load. An algorithm which is highly susceptible to TMTO has poorly defined memory hardness, which at the very least complicates analysis. It may also cause an algorithm to fail to be optimization free.