The best of both worlds We can have a function that is sequential memory-hard with a small amount of RAM (a few MB) ROM-port-hard with a large amount of ROM (many GB) Trivial: compute e.g. scrypt and our ROM-port-hard function sequentially (feeding the output of one into the other) or independently (then combine the outputs e.g. using a fast hash) Drawback: an attacker may use smaller memory machines to compute the scrypt portion Smarter: merge the two functions, interleave the memory access types In scrypt terms, this can be done in SMix or BlockMix The block size and relative frequency of small RAM and large ROM accesses may be tunable in case different memory types are being used or caching plays a role