A major part of what makes our secondary PoW of Cuckaroo29 ASIC-resistant is frequent tweaking. The first such tweak is due 6 months after genesis, in mid July. Which is now only about 6 weeks away.
In the 133 days of Grin mining so far, there is no sign of any ASIC mining. We do know of several ASIC products planned to come out in Summer.
To the extent that any such ASICs have built in support for Cuckaroo29, we want our tweak to brick that support.
There are 3 separate aspects of Cuckaroo that could be tweaked:
- the underlying hash function, currently siphash-2-4
- the computation of endpoints of a whole block of edges
- the type of cycle
Iāve chosen to leave 2) entirely alone and make tweaks in 1) and 3).
The tweaked siphash is defined by templating on one of the rotation amounts:
template <int rotE = 21>
class siphash_state {
...
void sip_round() {
v0 += v1; v2 += v3; v1 = rotl(v1,13);
v3 = rotl(v3,16); v1 ^= v0; v3 ^= v2;
v0 = rotl(v0,32); v2 += v1; v0 += v3;
v1 = rotl(v1,17); v3 = rotl(v3,rotE);
v1 ^= v2; v3 ^= v0; v2 = rotl(v2,32);
}
and using siphash_state<25> in cuckarood rather than the default 21.
The new type of cycle is a directed one. Half the edges (those with even index) are directed from U to V and the other half (with odd index) is directed from V back to U. Alternatively, we can just say that the cycle must alternate between even-indexed and odd-indexed edges. At the same time the number of nodes in each of U and V is halved. So Cuckarood29 will have 2^28 U-nodes + 2^28 V-nodes, 2^28 U->V edges, and 2^28 V->U edges.
Curiously, this results in twice the expected number of cycles.
We will not be making any difficulty adjustments. That means that if half the current Cuckaroo29 miners fails to upgrade, then the secondary PoW solution rate will remain unchanged. If everyone upgrades in time, then average block time could drop to 36 seconds, but ar_scale will adjust downward to compensate and things will normalize in a few hours.
About the name: the appended ādā mostly stands for directed, but as in SHA256d could also denote a doubling (of solutions).
Implementation wise, there is a new cuckarood directory at https://github.com/tromp/cuckoo/tree/master/src/cuckarood
In there you can find the new verifier in cuckarood.hpp and both a simple CPU miner and a CUDA mean miner.
A Grin PR is available at
