This work is theoretically very interesting, but nowhere does the paper explore what parameter choices would make its use in e.g. bitcoin practical. In particular, would n be close to a million? How large would the problems (f,x) be? How large are the solutions? Both of these would need to be included in the block header which is currently only 80 bytes long. Any sizes substantially larger than a few KB would make this rather impractical. What are the best known implementations for these sizes? How many seconds does it take to solve and how many to verify a solution?