Is equihash/scrypt suitable for pooled mining?

A "sequential memory-hard" PoW scheme cannot be parallelized effectively thus I imagine you also can't distribute solving the puzzle between participants in a pool? How does that work with scrypt then - for instance how do litecoin mining pools work?

Correct me if I am wrong, but equihash is "just" memory-hard. I understand you are solving a generalized birthday problem among randomly generated bitstrings. But my question here is: how does the pool verify you are actually doing meaningful work. Like with a "traditional" PoW you submit partial solutions that don't match the network difficulty but still have some difficulty "attached" that prove you did some work.

For equihash I believe there is no "partial" solution, either you find the inputs that xor to zero or you don't. What am I missing?

Are there any zcash mining pools out there yet? How do they ensure "fairness"?

fiction

Posted 2016-10-29T13:04:36.723

Reputation: 195

First part of my question can probably be explained: one scrypt calculation is hard to be sped-up using multiple threads, but you can always do multiple of them (with different nonces). Each of them still needs lots of memory. So basically multiple people calculate completely different scrypt invocations.

For the second one I probably don't understand how zcash exactly utilizes equihash and I'd be glad if someone can explain that. – fiction – 2016-10-29T19:24:12.543

Answers

I should have read the Equihash paper.

Basically the PoW is still one big loop going over a 160-bit nonce, but in the body there is the solving of the generalized birthday problem using Wagner's algorithm.

The parameters are pseudorandomly generated (using a hash function based on previous block and nonce) and at the end the solution is again hashed and the number of leading zero bits (of that solution) determines the difficulty. I guess that is why zcashd reports solutions/s and not hashes/s since one solution is one try of a different nonce (and you need a lot of them to get lucky).

SHA256 and Blake2B cryptographic one-way hash functions are still used (I previously thought they weren't), but the speed of calculating them does not dominate mining speed anymore.

fiction

Posted 2016-10-29T13:04:36.723

Reputation: 195

I found https://minezcash.com/zcash-mining-pool/ so apparently there are quite a few zcash mining pools already.

Regarding the difficulty question I am currently looking at https://github.com/str4d/zcash-pow/blob/master/pow.py What is irritating me is that there still is a SHA256 calculation apparently.

fiction

Posted 2016-10-29T13:04:36.723

Reputation: 195