[sodality2]

Ideally you'd have something that's hard for the client but easy for the server to verify, though. so maybe prime factoring?

[tshaddox]

Or, the server provides a random string of bits with length n and requires a string of bits with length n+m that starts with the provided n bits and whose SHA-1 hash begins with 20 zero bits.

[wruza]

What nonceness!