I'm planning to implement a public mailbox for receiving feedback, and I'd like to use hash-based proof-of-work to frustrate spammers.
First, we want to use 320-bit capacity Gimli permutation as the underlaying primitive for the sponge-based hash function, because
I don't want to make it hard for server to re-evaluate KDF each time there's a message,
it's not available on commodity hardware, which means someone will have to pay for silicon to have it accelerated,
less parameters to tune (capacity/rate and preimage length).
Second, for each message, there will be a time-based challenge (server will allow a small window for error) prepended to each message to be hashed and sent to deter pre-computation attacks.
However, there's a few things I'm not confident about. Namely:
Whats the advantages and disadvantages of using plain hash and KDFs when used in POW?
Besides replay, pre-computation, what are the other attacks that must be considered in designing a secure proof-of-work system?