This compares well to scrypt, which displays a cost of O(R^{2}) when the memory usage is O(1),[REF] and with other solutions in the literature, for which the best result is O(R^{T+1}) [REF].
Nonetheless, in practice these solutions usually involve a value of R (memory usage) lower than those attained with the Lyra2 for the same processing time [REF].