Memory-expensive hash from an array of hashes? Why can't people make a hash function that requires dozens of mega bytes of memory instead of cpu to avoid all the cracking and hacking?
What I have in mind myself is this:


We have an input $X$, we choose hash function SHA2-256,  make a multi-megabyte array.
Hash $X$ and put it in the beginning of the array.
Hash the previous hash and put it next to it.
$(hash(x), hash(hash(x)))$
Step 3 until the array is full
Reverse the array
Hash the array in N passes, In each pass reading 1 byte and skipping $N-1$


I'm planning to use this for authentication, I'm not sure if it's a good idea or not, just need to know if it stop the damn GPUs from cracking my passwords.

EDIT:  

This is why people shouldn't make their own encryption – see the comment by John Meacham proving this algorithm insecure. An easy fix IMO is to require the algorithm to go multiple passes over the reversed array. Like: get the first byte, skip 15 bytes, get another byte and so on… and when we reach end of the array, start from beginning, only this time we get the second byte, skip 15 bytes and so on… and we do this 16 times until we have read every byte in the array. Of course number $16$ is probably not a good number but still I think the whole idea is good.
The premise that people cannot make a memory intensive password hashing function is incorrect. scrypt does approximately what is described in the question. Of course you still want to limit the amount of memory, especially if many of these hashes are to be calculated in parallel.

Furthermore, you could have a look at the password hashing competition where m_cost is specifically mentioned as a possible parameter to the hash function. You'll have to look at the candidates to see if that parameter is present and how it is used though.

Note that the main idea of using larger amounts of memory is to protect against brute force attempts that make use of hardware acceleration. Just scaling up the amount of memory to rely on the speed of memory access does not make sense; an attacker may have a system that does faster memory access than your system. It's less likely that an attacker has both hardware acceleration and a hugely fast &amp; large memory system.