scrypt at low memory scrypt accesses memory in cache line sized chunks, which lets it use the memory bus efficiently The attacker's cost is meant to be RAM itself, not bandwidth When scrypt is set to use only a small amount of memory (~1 MB or less), it is weaker than bcrypt at least as it relates to attacks on GPU At 128 KB, as demonstrated by scrypt's use in Litecoin, scrypt is ~10x faster on GPU than on CPU (whereas bcrypt is currently not faster on GPU than on CPU) GPU cards' RAM bandwidth exceeds CPUs' L2 cache bandwidth