Verifiable Random Functions y z Silvio Micali Michael Rabin Salil Vadhan Abstract random string of the proper length. The possibility thus ex- ists that, if it so suits him, the party knowing the seed s may We efficiently combine unpredictability and verifiability by declare that the value of his pseudorandom oracle at some x f x extending the Goldreich–Goldwasser–Micali construction point is other than s without fear of being detected. It f s of pseudorandom functions s from a secret seed , so that is for this reason that we refer to these objects as “pseudo- s f knowledge of not only enables one to evaluate s at any random oracles” rather than using the standard terminology f x x NP point , but also to provide an -proof that the value “pseudorandom functions” — the values s come “out f x s is indeed correct without compromising the unpre- of the blue,” as if from an oracle, and the receiver must sim- s f dictability of s at any other point for which no such a proof ply trust that they are computed correctly from the seed . was provided. Therefore, though quite large, the applicability of pseu- dorandom oracles is limited: for instance, to settings in which (1) the “seed owner”, and thus the one evaluating 1Introduction the pseudorandom oracle, is totally trusted; or (2) it is to the seed-owner’s advantage to evaluate his pseudorandom oracle correctly; or (3) there is absolutely nothing for the PSEUDORANDOM ORACLES. Goldreich, Goldwasser, and seed-owner to gain from being dishonest. Micali [GGM86] show how to simulate a random ora- f x One efficient way of enabling anyone to verify that s b cle from a-bit strings to -bit strings by means of a con- f x really is the value of pseudorandom oracle s at point struction using a seed, that is, a secret and short random clearly consists of publicizing the seed s.However,this string. They show that, if pseudorandom generators exist f will also destroy the unpredictability of s : anyone could [BM84, Yao82], then there exists a polynomial-time algo- f easily compute the value of s at any point. s rithm F such that, letting denote the seed, the func- We instead wish to provide a new type of pseudoran- def a b f F s f g f g tion s passes all effi- dom oracle. Informally, we want one in which the owner f cient statistical tests for oracles. That is, to an observer s of the seed can, as usual, evaluate s at any point, but with sufficiently limited computational resources, accessing also prove (with an NP proof ) that the so obtained values a b g f g a random oracle from f to is provably indis- are indeed correct without compromising the unpredictabil- f s x tinguishable from accessing (as an oracle) ,evenifal- f ity of the value of s at any point for which no proof F s x gorithm is publicly known (provided that is still kept f of correctness for s is given. That is, given an input secret). x, the seed-owner should be able to produce in polynomial v f x proof time the value s together with a string ef- x THE PROBLEM OF CONSTRUCTING VERIFIABLE PSEUDO- ficiently proving that v is correct. The scheme should have RANDOM FUNCTIONS. By its very definition, a pseudoran- the property that a unique value v is provable as the value f x dom oraclea ` la [GGM86] is not verifiable: without knowl- of s . We call such a mathematical object a verifiable edge of the seed (or any other additional information), upon (pseudo-)random function, VRF for brevity. z f receiving the value of a pseudorandom oracle s at point x, one cannot distinguish it from an independently selected A WEAKER SOLUTION: PSEUDORANDOM ORACLES + ZERO-KNOWLEDGE PROOFS. If interaction were allowed, Laboratory for Computer Science, MIT, Cambridge, MA 02139. VRFs could be constructed from GGM pseudorandom or- y Department of Applied Science, Harvard University, Cambridge, MA 02138. Work supported in part by NSF Contract CCR-9877138. acles via zero-knowledge proofs [GMR89] and a commit- z MIT Laboratory for Computer Science. 545 Technology Square. ment scheme. Indeed, as suggested in a signature scheme Cambridge, MA 02139. E-mail: [email protected]. of Bellare and Goldwasser [BG89], the owner of the seed URL: http://theory.lcs.mit.edu/˜salil. Supported by a DOD/NDSEG fellowship and partially by DARPA grant DABT63-96-C- Strictly speaking, we actually allow “MA proofs”, since their verifi- 0018. cation may be probabilistic. s f c to a pseudorandom oracle s can publish a commitment changed. But VRFs may also be useful in settings where v to s. Whenever he wishes to prove that is the value of his the public key is provided “on the fly” to prove that vari- V oracle at a point x to a verifier , he proves in zero knowl- ous function values (given previously or at the same time) V v f x c s edge to that s and that is a commitment to . are indeed consistent with one single VRF. In case the VRF Such a statement is provable in zero knowledge because all outputs strings longer than the public key, it may even be NP statements are provable in zero knowledge [GMW91]. useful to provide the public key on the fly to prove that The trouble with such an approach is that it requires inter- a single value is consistent with some VRF, as this would action. A very efficient incarnation of this idea is given by limit the owner to relatively few choices. Naor and Reingold [NR97], but it still suffers from the need In addition to introducing this notion, we provide an ex- for interaction. plicit VRF construction, based on a variant of the RSA as- Such interaction could be removed by using noninter- sumption. Informally stated, we prove: active zero-knowledge proofs (NIZK) [BFM88, BDMP91], as done by Bellare and Goldwasser [BG89]. This ap- Main Theorem: Assume that the RSA function with proach however suffers from another drawback: noninterac- large prime exponents cannot be inverted in polyno- g tive zero-knowledge proofs presuppose that the prover and mial time. Then, there exists a VRF from f into g verifier share a bit-string that is guaranteed to be random. f . So the question is who is to select this shared random string R . Each of the possibilities has a deficiency that we wish to OVERVIEW OF THE CONSTRUCTION. We motivate our avoidindefining VRFs: construction by first discussing the relationship between 1. The seed owner selects R : If the seed owner selects the VRFs and secure signature schemes. In a signature scheme shared random string improperly, the soundness of the that is existentially unforgeable against a chosen message NIZK proof system is no longer guaranteed, so there attack [GMR88], the signature of a message x, denoted v f x maybemanyvalues that are “provable” as s . x SIG , is a value that is unpredictable (even given sig- 2. The verifier selects R :Iftheverifier selects the shared natures of chosen other messages), but verifiable (given the random string improperly, the zero-knowledge prop- proper public key). However, such schemes do not directly x SIG x erty of the NIZK proof system is no longer guaranteed. give rise to VRFs by setting f to be ,fortwo f x v Thus, by proving s with respect to such an reasons: improperly chosen R , the prover may leak knowledge 1. There may be many valid signatures for a given string s f about the seed and s will “lose” its pseudorandom- x (violating the unique provability requirement). ness. x 2. SIG is only unpredictable, not necessarily pseudo- 3. The seed owner and verifier jointly select R by a “coin- random. flipping” protocol.: This requires interaction, which we wish to avoid. We begin by discussing the first deficiency, as it is the 4. A trusted third party selects R : We do not want to as- more serious one. Even though the definition does not guar- sume the existence of such a trusted third party. antee the uniqueness of signatures, one might hope that ex- isting signature schemes happen to have this property. How- ever, most known secure signature schemes are either prob- OUR SOLUTION. We propose a notion of VRF’s which abilistic or history dependent. Either property violates the needs neither interaction nor sharing a guaranteed ran- x the unique provability requirement: if we define f to be dom string. Rather, we only require that the owner of the x x SIG , there may be a multiplicity of signatures of and PK function f publish a public key , which can be viewed x thus a multiplicity of f values, all duly provable. One as a commitment to the function f . (Indeed, something can transform a probabilistic signature scheme, such as the must bind the owner to the function in order for “proving scheme in [GMR88], into a deterministic one if the signer xv the statement f ” to make sense.) The crucial way uses a GGM pseudorandom oracle to replace the random- in which our notion differs from what the NIZK-based ap- ness used. Even so, this does not yield a VRF because one proach discussed above achieves is: cannot be certain that the signer used the proper GGM ora- x cle when producing SIG , and hence unique provability For any public key PK , even an improperly chosen one,a is NOT guaranteed. f x unique value v is provable as the value of .