Various systems (such as bitcoin/namecoin, GNUnet Network Size Estimation) need
cryptographic hash functions that are *hard* to calculate in parallel -- and
ideally remain expensive even if the adversary can throw GPUs or even custom
hardware at the problem. A few hash functions have been designed with
proof-of-work applications in mind, such as bcrypt
(http://en.wikipedia.org/wiki/Bcrypt) and scrypt
(https://tools.ietf.org/html/draft-josefsson-scrypt-kdf-00). It would be
helpful if such a hash function was supported by libgcrypt, as then we don't
have to put an implementation into GNUnet...