Since we're on the XMR/BBR topic again something that's always bugged me or made me curious at least is the fact that Bytecoin/Monero uses what sounds like a completely new algo(CryptoNight). Which sounds like a really odd choice to me considering what kind of testing and rigor all these other new algos(BLAKE, Grøstl, Keccak ect) have gone through via the NIST competition.
Obviously SHA-2 has been considered a huge success thus far and doesn't look to have any major attacks according to public information despite it being expected to be showing cracks by now(and thus the NIST competition to find 'SHA-3'). Of course no one is using SHA256 anymore in the altscene for obvious reasons, but BBR went with their implementation of ('Wild')Keccak which was the winner of the 'SHA-3' competition and thus went through extremely rigorous testing from some of the top cryptographers in the world.
Maybe I'm thinking this is a bigger issue than it is, but I would expect more people to be complaining about this novel algo that CN uses. Unless of course it's just one or more of those new NIST competition algos with their own name slapped on it. But it doesn't say that on the Bitcoin wiki or the CN website. For all I know it could be worthy of being submitted alongside all those other algos if the competition were still going on but I don't really know.
The algorithm has little value as a general purpose hashing tool. It is purpose built for proof-of-work.
The design is heavily influenced by the desire to resist attempts to massively accelerate it on GPUs or ASICs, or to put it another way, to ensure that similar-cost devices will perform similarly, at least for some period of time.
So far this objective has been largely achieved with GPUs. GPU miners don't outperform CPUs that much on a hash/$ metric and don't outperform them at all on a hash/W metric. It remains to be seen how well it does with ASICs.
Your point about testing and rigor is valid. It is possible to surmise that with some level of obvious competence having gone into the design, there may have been significant testing, analysis, and scrutiny. Or there may not. Since it is all shrouded in secrecy, we just don't know.
I've been discussing this at length in the XMR thread, but I'm done for a while. I think it's interesting enough that it deserves a more careful writeup, and I'm putting that on my todo list when I have a bit of time for academic-crypto-fun.
A very quick answer is: I've spent a lot of time looking at CryptoNight and believe it to be very solid. There are some potential things to think about in the long term, but assuming you accept its technical tradeoffs (slow block verification leading to increased susceptibility to block-flooding DoS attacks, in favor of a balance between CPU, GPU, and ASICs), I don't believe it's an issue that should be concerning in the next few years.
Note that GPUs *do* outperform CPUs, of course -- it's just that it's only a factor of two or three. Which is pretty remarkable. And an ASIC will likely outperform a GPU, but I'm guessing it will be in the ~5x better range, not huge.
Instead of writing yet-another-long-note about this that will just be ignored, I'm going to devote time later thinking a bit more about a semi-formal analysis of it. I'll annoy AnonyMint here and pull rank: The reason you might believe me in the meantime is that I've broken several other PoW schemes, wrote the optimized code that's in the XMR CPU miners you're using today, and have one of those useless pieces of paper that claims I'm a Ph.D. computer scientist.
None of that means I'm right. Nobody has done a seriously rigorous analysis of it. I could be completely wrong! It just means you might feel more comfortable trusting my quick judgement about it than the judgement of some random poster making unsubstantiated claims about its weakness and refusing to back them up with any evidence. And I'm putting it out there under my real name so you can hold me to it; I value my reputation far more than I stand to benefit from convincing people to buy or not buy silly currencies.
What I'm specifically not saying here:
* ASICs won't be better. Of course they will. The question is how much, and I think the answer is "MUCH less beneficial than with bitcoin, and substantially less beneficial than with scrypt."
* CPU-friendly is a good or bad idea. That's a philosophical question outside what I'm discussing.
* The tradeoff of verification time is a good one. Again - that depends on a lot of other factors. It's the part about CryptoNight that makes me most nervous, but there are likely other ways to mitigate block-flooding attacks, so it doesn't need particular panic.
-Dave