user10725: I was thinking of permuting bits in a block before it is hashed, in order to require some adaptability from the mining hardware while retaining the security of SHA-256.
Permutations would depend on the hash of the previous block so that they cannot be anticipated.
They would also depend on the nonce, so that the permutation step would have to be performed once per hash, preventing a single external CPU from efficiently preprocessing the data.
A simple example of algorithm:
Seed a pseudo-random number generator with the hash of the previous block appended to the nonce. Draw 1000 pairs of pseudo-random numbers between 1 and the length of the block in bits. Swap the bits corresponding to these pairs. Hash with SHA-256.
It seems to me these permutations would be particularly troublesome to implement electronically, and I was thinking this might drive up the cost of ASIC implementations.

user638: Your solution will least at most a year until dynamically reconfigurable FPGAs appears in the market. Then creating any logic circuit on the fly will be possible, and so efficient FPGAs will outperform CPUs by a large margin.
See for example: http://en.wikipedia.org/wiki/Partial_re-configuration

user4748: When creating a new crypto-currency, a compromise must be made regarding the proof-of-work algorithm. Should the algorithm selected be CPU-only, or the opposite? Both options have their pro's and con's.
Should the creators use an algorithm that's easy to run on either an ASIC or a GPU, then the bar is raised for potential miners - this means no worms will try to create swarms of 0wned computers to mine the currency, but it also means people who can only mine with CPU won't be interested in mining it at release time precisely because they know they will be set appart really soon.
If, on the other hand, they purposefully select a CPU-only then people galore will attend the launch and start mining the coin, but it'll also mean botnets will start mining it as well and some people will use cloud computing or shared CPUs (theirs or from others to mine it).
To see an actual example, look at what happened when Primecoin was launched: the ultimate CPU-only coin (some experimental GPU miners exist, but alas - they're less capable than CPU ones), some worms started soon propagating to recruit machines to put them to mine.
Also, plenty of people would use their accounts at these services which bill you by the amount of CPU you use and started using their share-time to mine Primecoin - to the point some servers of these server-providers collapsed, whereas others kicked off these miners for violations to terms of service.

10725: <p>I was thinking of permuting bits in a block before it is hashed, in order to require some adaptability from the mining hardware while retaining the security of SHA-256.</p>

<p>Permutations would depend on the hash of the previous block so that they cannot be anticipated.
They would also depend on the nonce, so that the permutation step would have to be performed once per hash, preventing a single external CPU from efficiently preprocessing the data.</p>

<p>A simple example of algorithm:</p>

<p>Seed a pseudo-random number generator with the hash of the previous block appended to the nonce. Draw 1000 pairs of pseudo-random numbers between 1 and the length of the block in bits. Swap the bits corresponding to these pairs. Hash with SHA-256.</p>

<p>It seems to me these permutations would be particularly troublesome to implement electronically, and I was thinking this might drive up the cost of ASIC implementations.</p>
 638: <p>Your solution will least at most a year until dynamically reconfigurable FPGAs appears in the market. Then creating any logic circuit on the fly will be possible, and so efficient FPGAs will outperform CPUs by a large margin.</p>

<p>See for example: <a href="http://en.wikipedia.org/wiki/Partial_re-configuration" rel="nofollow">http://en.wikipedia.org/wiki/Partial_re-configuration</a></p>
 4748: <p>When creating a new crypto-currency, a compromise must be made regarding the proof-of-work algorithm. Should the algorithm selected be CPU-only, or the opposite? Both options have their pro's and con's.</p>

<p>Should the creators use an algorithm that's easy to run on either an ASIC or a GPU, then the bar is raised for potential miners - this means no worms will try to create swarms of 0wned computers to mine the currency, but it also means people who can only mine with CPU won't be interested in mining it at release time precisely because they know they will be set appart really soon.</p>

<p>If, on the other hand, they purposefully select a CPU-only then people galore will attend the launch and start mining the coin, but it'll also mean botnets will start mining it as well and some people will use cloud computing or shared CPUs (theirs or from others to mine it).</p>

<p>To see an actual example, look at what happened when Primecoin was launched: the ultimate CPU-only coin (some experimental GPU miners exist, but alas - they're <em>less</em> capable than CPU ones), some worms started soon propagating to recruit machines to put them to mine.</p>

<p>Also, plenty of people would use their accounts at these services which bill you by the amount of CPU you use and started using their share-time to mine Primecoin - to the point some servers of these server-providers collapsed, whereas others kicked off these miners for violations to terms of service.</p>
