Quote from: weav on June 25, 2013, 05:14:04 PM

Quote from: DeathAndTaxes on June 25, 2013, 04:40:22 PM

Quote from: weav on June 25, 2013, 03:18:46 PM

The biggest and really significant weakness of BTC is SHA-256, that is ASICs (which are a very genuine threat feasible for any dedicated attacker, getting a design and building a semiconductor fabrication plant can be had for a few $M). All renowned cryptographers agree that scrypt is far superior.

It is fairly easy to make a scrypt ASIC the only factor is cost. However the scrypt used in LTC (and clones) was modified to make it about 10,000 less memory hard then the recommended default value. LTC scrypt uses about 32KB of memory, a token amount in ASIC design. LTC likely will never become popular enough to warrant the kind of investment but if it does ASIC builders will move to that chain as well.

Of course it is all about cost, that is my point. You cannot get a likewise efficient (this is the keyword here) LTC ASIC design and a manufacturing plant for a few $M. Despite of the scrypt memory requirement relaxation in LTC we are still talking about 4 or 5 orders of magnitude. Nobody came ever close to an efficient LTC ASIC even in theoretical designs, so much for "token amount". Cheesy

Quote from: DeathAndTaxes on June 25, 2013, 04:40:22 PM

Your last line is a false statement. Please provide this extensive list of renowned cryptographers who believe scrypt is far superior. Scrypt has been far less extensively studied than SHA and thus has a higher risk of a cryptographic flaw. Of course SHA could also be flawed but other than maybe MD5 or AES there aren't many algorithms with more peer review. Extensive and long peer review is mandatory to ensure cryptographic strength.

Your statement is false, MD5 for example has the most extensive and longest peer review, and is the notoriously most flawed of all the above, as was pointed out by renowned cryptographers years ago (see Wikipedia). I will give you the people involved in the design and subsequent discussions of scrypt and I'm quite sure you will recognize some of them. But as it just takes one counterexample to demonstrate my statement is false while you (and by extension I) cannot extensively prove a negative, I challenge you to provide just one single renowned cryptographer who doesn't believe scrypt is far superior, good luck.

Quote from: DeathAndTaxes on June 25, 2013, 04:40:22 PM

The first paper on scrypt was published less than 5 years ago and that is a tiny amount of time in the field of cryptography. Also LTC (and clones) use a modified version of scrypt which is significantly less "memory hard" by a couple orders of magnitude. The LTC developers are not world renowned cryptographers, there has been no extensive peer review of the effect of these modifications. There has (AFAIK) been a single academic paper on the potential risks.

Simple version: In cryptography tried and true is superior to new and flashy. In time scrypt "may" become the defacto standard for key derivitive functions but that day isn't today.

In cryptography you rely on what's currently trusted by most cryptographers, and that algorithm for hashing or key derivation is currently scrypt. SHA-256 is broken both theoretically by definition (see Wikipedia) as well as in practice because of ASICs, and so is BTC.

since the conversation has tipped to algo's and security, i'd like to point out that Gost-cipher and Whirlpool-T have yet to be broken.