How well does scrypt perform on different architectures / OSes? The scrypt algorithm seems to be a prominent feature in the "CPU friendly" Bitcoin clones for the proof-of-labor part. I've heard claims that it's relatively slow on Windows and/or Intel compared to Linux/AMD.

Is this true? By how much? Does anyone have concrete data on this? Is there a difference between 32 bit and 64 bit OS?

Bonus : could it be implemented more efficiently (power consumption and/or hardware cost wise) on dedicated hardware?
I've heard claims that it's relatively slow on Windows and/or Intel compared to Linux/AMD.


The claim that it could be Windows/Linux is a little off. It is more likely to be Intel/AMD, if anything. This will be an implementation detail based on the relative costs of processor instructions on each architecture; for example inc instructions are cheap on AMD, but costly on core 2 processors (relative to the speed of processors. You won't notice this difference unless you measure it). 

In order to see numbers I suggest having a read of the x86 latency measurements made during the development of libgmp. They're slightly dated, but give you a fair idea that in fact not all assembly instructions cost equal.

Does this mean scrypt performs better on one processor or the other? Not at all. It means the implementation of scrypt measured performs better on one processor or the other. You should be able to produce optimised versions of scrypt for each architecture. This is, internally, what libgmp does for your multiprecision arithmetic - the optimised code for your architecture is the one you link to.

I'm not really a compiler expert, so I can't really comment on the behaviour of C compiled versions, but to achieve full optimisation you'd likely need to start from the assembler output of a compiler anyway.