Large memory PoW with fast verification, third version:

The miner sends h and λ_i as proof.

h is the block hash value.
λ_i is a key for an elliptic curve point.
i is the value h MOD N.
N is the number of keys used.

The verifier calculates a point p_i on the elliptic curve. The proof is valid if p_i = λ_iG_j and h XOR hash(λ_i) is less than the target difficulty, where λ_i > 1. G_j is a member of a set G with predefined constant points on the elliptic curve. The points in G are chosen so that there is at least one nontrivial solution to p_i = λ_iG_j for all points p_i.

The point p_i is calculated by setting x to hash(i) MOD M, where M is the order of the finite field F_M for the elliptic curve y² = x³ + 7. N < C < M, where C is a value for 1% hash collisions. If no solution y is found for x, then x = x + 1 until a solution is found.

Since the calculations of p_i and λ_iG_j are easy the verification is fast without the need for much memory. The miner on the other hand needs the value λ_i which is difficult to calculate and therefore the miner has to store all keys λ_i, i = 0, ... N-1 in memory as pre-calculated values.