Ah, true, I forgot about it. With the following remark in specs (<a href="https:&#x2F;&#x2F;password-hashing.net&#x2F;submissions&#x2F;specs&#x2F;Gambit-v1.pdf" rel="nofollow">https:&#x2F;&#x2F;password-hashing.net&#x2F;submissions&#x2F;specs&#x2F;Gambit-v1.pdf</a>):<p><i>Keccak is known to be very fast in hardware, which opens up the path to highly optimized cheap circuits.</i><p>(although with strange follow-up: &quot;but the same can be said about modern CPUs and GPUs, which closes the gap&quot;)<p>As I wrote when discussing candidates, &quot;I like the simplicity of Gambit, but it would look a bit silly if we selected an algorithm as a winner of competition with a notice that it better be used in the future, when Intel adds a SHA-3 instruction.&quot;