Eaglesong algorithm: the Nervos CKB network, hardware and specs

Eaglesong is a proof of work algorithm written specifically for the Nervos CKB network and used nowhere else in any serious way. Its author, Alan Szepieniec of the Nervos Foundation, published the specification in July 2019 as RFC 0010, together with reference implementations in C and Python. Inside there is a sponge construction like the one in Keccak, but the permutation is built in ARX style: modular addition, bit rotation and XOR only, with no substitution tables.

The main thing to understand about Eaglesong is that nobody tried to make it ASIC resistant. The opposite: Nervos stated openly that it wanted a simple, easily understood algorithm so that the entry barrier for chip makers would be low and the hardware market would end up competitive rather than a monopoly. The plan worked. The first production ASIC shipped less than half a year after the main network launched, and four separate companies were building such machines.

For a buyer the key number here is the spread inside the catalog. We list 8 models on Eaglesong, and the difference between the best and the worst is almost thirty times: the Antminer K7 delivers 48.5 J/TH, the early Antminer K5 needs 1398 J/TH. These are not shades of the same thing; they are different eras of silicon, and buying the second machine at the price of the first means an electricity bill that no exchange rate will ever justify.

The work of a miner is the usual one: find a nonce that makes the block header hash land below the current target. What is unusual is the way that hash is computed. Eaglesong works as a sponge: the input data is absorbed into a 512 bit state, the state is stirred by a permutation, then 256 bits of result are squeezed back out of it.

The permutation itself is built in ARX style, from add, rotate, xor. No substitution tables, no multiplications, just three cheap operations on 32 bit words. One round consists of four steps: multiplication by a bit matrix, a circulant multiplication with rotation coefficients, addition of a constant from a table, and a closing add-rotate-add step on pairs of words. There are 43 rounds and 688 constants across them.

Why that choice matters for hardware. Addition, rotation and XOR map into silicon with almost no overhead and need almost no memory. The chip comes out dense and cheap to design, and the bottleneck is the number of parallel pipelines and the clock rate rather than memory bandwidth as in Scrypt. That is exactly why Eaglesong grew dedicated hardware so quickly.

One more thing to know: the Nervos test network computes a variant called EaglesongBlake2b, where one more hash is applied to the result. That was done to make cheap attacks on the test network harder. The main network computes plain Eaglesong, and all the hardware is designed for exactly that.

1. Block headerVersion, parent hash, transaction and proposal roots, time, difficulty, nonce
2. AbsorbingThe header goes into a 512 bit state, rate 256 bits, capacity 256 bits
3. 43 permutation roundsBit matrix, circulant multiplication, constant, add-rotate-add step
4. Squeezing256 bits are taken out of the state, and that is the block hash
5. Comparison with the targetBelow the target, block found. Above it, a new nonce and start again

• 2018Nervos formulates its economic model: space in the network state is paid for separately, storing data on chain is not free.
• 2019In July Alan Szepieniec publishes RFC 0010 describing Eaglesong. The algorithm later appears in an academic journal as well, with proven bounds on resistance to differential and linear cryptanalysis.
• 2019On 16 November the Lina main network launches at epoch 0. The reward per epoch is 1,917,808 CKB.
• 2020In March and April the first production machines arrive: the Todek Toddminer C1, followed by the Bitmain Antminer K5. Less than half a year after the network launch.
• 2021Over two years, through 2022, Goldshell rolls out the entire CK lineup: CK5, CK-BOX, CK6, CK Lite, CK6-SE, CK-BOX II. The home segment and the industrial one arrive almost at the same time.
• 2023In January the Antminer K7 at 63.5 TH/s raises the bar: 48.5 J/TH against the 171 J/TH of the previous leader in the catalog. A gap of three and a half times.
• 2023On 19 November the first halving of the base issuance arrives, the reward per epoch drops to 958,904 CKB. The next one is expected in November 2027.
• 2025On 1 July the Meepo hard fork lands on the main network: the Spawn syscall and the second version of the virtual machine. The fork changed neither the algorithm nor the issuance.

All 8 catalog models on Eaglesong, sorted by efficiency with the best on top. Hashrate in TH/s, efficiency in joules per terahash. Click the name to open the profitability calculator for that model.

There is no custom firmware for Eaglesong. That has to be accepted before buying, not discovered afterwards. AsicBoost firmware is built for SHA-256 boards, on Scrypt two models are supported, and no CKB series is on that list. Network installation through HashCore Toolkit covers the same supported lines.

The same holds for third party developers in general. None of the known alternative firmware projects for Antminer claims support for the K5 or the K7. Goldshell publishes only its own official builds for the CK5, CK6 and CK-BOX, and the change logs there are about Wi-Fi stability and idle mode, not about overclocking.

Online you will run into videos and listings promising to push a K7 to 90 TH/s and add half again to its efficiency. There is usually no author to be found behind such builds, the working terms and the developer fee are not stated, and the origin of the file is unknown. We do not recommend putting that on a machine worth several thousand euro: the risk of a brick and a voided warranty is real, and there is no confirmation of the result.

The practical conclusion is simple. The efficiency of an Eaglesong machine is fixed at the moment of purchase. There is nothing to improve it with later, so the J/TH figure has to be worked out before you buy, not after.

The income of an Eaglesong farm comes from three values: CKB network difficulty, the CKB exchange rate and your efficiency in J/TH. There are no side payouts, no merge mining, and a single coin.

The block reward here is arranged in a more complex way than in Bitcoin. It consists of the base issuance, which halves once every four years, a share of the secondary issuance, and fees. The secondary issuance is constant, 1,344,000,000 CKB a year, and is split between miners, Nervos DAO deposits and the treasury in proportion to the state of the network. Because of that the block reward floats more than Bitcoin miners are used to.

Difficulty behaves unusually too. CKB fixes the length of an epoch at 4 hours, while the number of blocks inside an epoch varies from 300 to 1800. The protocol tunes the interval to hold the orphan rate near 2.5 percent, so block time floats roughly between 8 and 48 seconds. For income calculations that means one thing: work from the daily output, not from the reward for a single block.

Open the profitability calculator →

Efficiency here is measured in joules per terahash, J/TH. The notation matches SHA-256, but that is a coincidence of notation, not of units: an Eaglesong terahash and a SHA-256 terahash are different work. Putting 48.5 J/TH on CKB next to 9.45 J/TH on Bitcoin is meaningless; the comparison only makes sense within the algorithm.

Inside the algorithm the spread is huge. The Antminer K7 delivers 48.5 J/TH, the Goldshell CK6 delivers 170.98, the old Antminer K5 needs 1398.23. Almost twenty nine times between the leader and the outsider. In practice that means the electricity bill differs many times over for the same output in CKB, and no purchase price compensates for it.

Work it out like this: take the efficiency of the model, multiply by the planned hashrate and you get the power draw. Then divide by 1000 to get kilowatts, multiply by your tariff and by 720 hours a month. Compare the sum with the mining forecast in the calculator. If the difference is already negative now, it will only get worse as difficulty grows.

Settle the coin question first. You are buying hardware for one network with no fallback scenario. If that concentration of risk does not suit you, look at SHA-256 or Scrypt, where the fleet can be moved to another coin.

Look at J/TH, not at terahashes. Hashrate tells you about speed, efficiency about the power bill. Choosing between two machines at a comparable price, the one with the lower J/TH almost always wins.

Separate home models from rack models. A CK-BOX at 215 watts and a CK6 at 3300 watts solve different jobs. The first is quiet and lives in a flat, the second needs a prepared room, a dedicated line and exhaust ventilation.

Check power and noise in advance. A 3300 watt machine means a dedicated breaker, decent cable and around 75 decibels. Do not treat that as a detail: most often a project stalls on the connection, not on the hardware.

Do not count on firmware. On Eaglesong there is nothing to improve. The factory numbers are your numbers for the whole time you own the machine.

Calculate payback on today's numbers. Take the current difficulty, the current rate and your real tariff. Better not to build price growth forecasts into the calculation: difficulty grows a lot more reliably than the rate.

Comparing J/TH with Bitcoin machines. The same unit notation does not make the work the same. Putting 48.5 J/TH on CKB next to 12 J/TH on Bitcoin is not valid; these are different algorithms and different terahashes.

Buying an old model for the low price. The Antminer K5 is cheap precisely because its efficiency is twenty nine times worse than the leader. The saving on the purchase burns off in the first month of bills.

Waiting for firmware that fixes everything. A custom firmware ecosystem for Eaglesong does not exist. The overclocking promises in listings and videos are backed by nothing.

Counting income from the block reward. On CKB the block time floats and the reward is made of several parts. The only sensible horizon for a calculation is a day.

Ignoring the liquidity of the coin. Mining CKB and selling CKB are two different jobs. Check in advance which venue you plan to exit through and how deep its order book is.

Sending everything to one pool. A pool can go down for maintenance or shut down. A backup address in the machine settings takes a minute and saves a day of downtime.