Pros of ROM-port-hardness (vs. scrypt) Can use ~1000 times more memory on current server hardware (and require as much memory in each node for efficient attack: anti-botnet) e.g., 10 to 240 GB of ROM (actually in RAM) vs. scrypt's 4 MB or 8 MB per thread Can use a server's full RAM capacity even when the current request rate is low (that is, when few hashes are being computed concurrently) Excellent scalability to more CPUs and CPU cores We only need to increase the amount of processing between memory accesses to be such that we stay just below saturating the memory bandwidth when all CPU cores are in use (unlike with scrypt, this does not result in reduction of memory usage) Can use types of memory other than RAM (e.g., SSDs)