Verifiable Random Functions β¨ and β¨ Verifiable Delay Functions Caleb Smith University of Virginia
Why do these matter? Alternative consensus protocols Applications to public randomness generation
Leader election Bitcoin Proof of Work style Everyone generates a random number, and the largest is the leader?
Generate random numbers Assume we have a hash function, , and we have a public challenge, h π¦ πππ§ β {0,1} π πππ§ β {0,1} π πππ§ β {0,1} π πππ§ β {0,1} π πππ§ β {0,1} π πππ§ β {0,1} π π§ = h ( πππ§ || π¦ ) π§ = h ( πππ§ || π¦ ) π§ = h ( πππ§ || π¦ ) π§ = h ( πππ§ || π¦ ) π§ = h ( πππ§ || π¦ ) π§ = h ( πππ§ || π¦ )
Generate random numbers Assume we have a hash function, , and we have a public challenge, h π¦ ? πππ§ β {0,1} π πππ§ β {0,1} π πππ§ β {0,1} π πππ§ β {0,1} π πππ§ β {0,1} π πππ§ β {0,1} π π§ = h ( πππ§ || π¦ ) π§ = h ( πππ§ || π¦ ) π§ = h ( πππ§ || π¦ ) π§ = h ( πππ§ || π¦ ) π§ = h ( πππ§ || π¦ ) π§ = h ( πππ§ || π¦ )
Verifiable Random Function Introduced by Micali, Rabin, and Vadhan in 1999 πΏππ§π»ππ ( 1 π ) β ( π‘π , ππ ) ππ ππ€π ( π‘π , π¦ ) β ( π§ , π ) Proof Pseudorandom πππ πππ§ ( ππ , π¦ , π§ , π ) β {0,1} Security Property: πΊππ πππ π¦ , ππ πππ€ππ π‘ππ π§ ππππππ’ ππππ π§ 0 β π§ 1 π‘π£π h π’ h ππ’ πππ πππ§ ( ππ , π¦ , π§ 0 , π 0 ) = 1 = πππ πππ§ ( ππ , π¦ , π§ 1 , π 1 )
Generate random numbers Assume we have a hash function, , and we have a public challenge, h π¦ ? π‘π , ππ β πΏππ§π»ππ π‘π , ππ β πΏππ§π»ππ π‘π , ππ β πΏππ§π»ππ π‘π , ππ β πΏππ§π»ππ π‘π , ππ β πΏππ§π»ππ π‘π , ππ β πΏππ§π»ππ π§ , π = π π ππ€π ( π‘π , π¦ ) π§ , π = π π ππ€π ( π‘π , π¦ ) π§ , π = π π ππ€π ( π‘π , π¦ ) π§ , π = π π ππ€π ( π‘π , π¦ ) π§ , π = π π ππ€π ( π‘π , π¦ ) π§ , π = π π ππ€π ( π‘π , π¦ )
Verifiable Random Function Assumptions RSA + Random Oracle [Micali, Rabin, and Vadhan 1999] Decisional Bilinear Diffie Hellman Inversion [Dodis and Yampolski 2004] Decisional Diffie Hellman + Random Oracle [Papadopoulos et al 2017]
Verifiable Delay Functions Introduced by Boneh, Bonneau, BΓΌnz, and Fisch in 2018 Delay β Takes a minimum amount of parallel time to compute Function β Unique outputs Verifiable β Third parties can verify that it was evaluated correctly
Verifiable Delay Function Alice wants to require Bob to spend solving a challenge π πππ πππππ π’πππ Unique solution Takes parallel time, π 10
Verifiable Delay Function Syntax A function that takes a long time to compute, has unique outputs, and can be verified quickly πππ’π£π ( π , π ) β ππ = ( ππ , π€π ) , specifies input and output space πΉπ€ππ ( ππ , π¦ ) β ( π§ , π ) , runs in at least πππ πππππ π’πππ π Proof from the Evaluator to help the Verifier , runs in time πππ πππ§ ( π€π , π¦ , π§ , π ) β { π΅πππππ’ , ππππππ’ } π’ βͺ π 11
Verifiable Delay Function Properties Sequentiality β Eval( π¦ ) cannot be solved in less than , πππ πππππ π’πππ π with ππππ§ ( π ) number of processors Uniqueness β If the adversary runs in time π ( ππππ§ ( π , π )) , then they are unable to find a π§ β πΉπ€ππ ( π¦ ) that passes verification 12
Application - Randomness Beacon Generate a stream of public random values π ( π 1 , π 2 , β¦, π π ) = r 1 r 2 r 3 r 4 r 5 r 6 β¦ r n π 1 β π 2 β β¦ β π π Can submit values from 1:00pm to 1:10pm 13
Application - Randomness Beacon Generate a stream of public random values h ( π 1 , π 2 , β¦, π π ) = π¦ r 1 r 2 r 3 r 4 r 5 r 6 β¦ r n ππΈπΊ . πΉπ€ππ ( π¦ ) β ( π§ , π ) Can submit values from 1:00pm to 1:10pm πΉπ¦π’π πππ’ ( π§ ) β π€ 14
Application β Proof of Space and Time Cohen and Pietrzak from Chia Change the assumption from majority of computing power is honest to 2/3 of committed disk space is honest Proofs of Space will populate some disk space with some function and π given a challenge, will find their βbestβ solution almost instantly
Why not just chain Proofs of Space? The next Proof of Space challenge is the hash of the previous Proof of Space solution and proof There are attacks where an adversary can βtweakβ elements in their control to bias the next challenge This does not occur in Bitcoin because of the cost to split resources
Adding Verifiable Delay Functions Take the solution and proof of the Proof of Space, ( π§ , π πππ ) , and π¦ = h ( π§ | π πππ ) , ππΈπΊ . πΉπ€ππ ( π¦ ) β ( π§ , π ππΈπΊ ) compute π ( π§ ) Then determines the next Proof of Space challenge We can now argue that an adversary cannot determine how to βtweakβ anything to bias the next challenge
Verifiable Delay Function Assumptions Repeated squaring in group of unknown order is inherently sequential Let be an RSA modulus where nobody knows the factorization π π¦ 2 π πππ π Conjectured to take sequential squarings π
Questions? 19
Recommend
More recommend
