Verifiable Random Functions The Harvard community has made this article openly available. Please share how this access benefits you. Your story matters Citation Micali, Silvio, Michael Rabin, and Salil Vadhan. 1999. Verifiable random functions. In Proceedings of the 40th Annual Symposium on the Foundations of Computer Science (FOCS `99), 120-130. New York: IEEE Computer Society Press. Published Version http://dx.doi.org/10.1109/SFFCS.1999.814584 Citable link http://nrs.harvard.edu/urn-3:HUL.InstRepos:5028196 Terms of Use This article was downloaded from Harvard University’s DASH repository, and is made available under the terms and conditions applicable to Other Posted Material, as set forth at http:// nrs.harvard.edu/urn-3:HUL.InstRepos:dash.current.terms-of- use#LAA Verifiable Random Functions y z Silvio Micali Michael Rabin Salil Vadhan Abstract random string of the proper length. The possibility thus ex- ists that, if it so suits him, the party knowing the seed s may We efficiently combine unpredictability and verifiability by declare that the value of his pseudorandom oracle at some x f x extending the Goldreich–Goldwasser–Micali construction point is other than s without fear of being detected. It f s of pseudorandom functions s from a secret seed , so that is for this reason that we refer to these objects as “pseudo- s f knowledge of not only enables one to evaluate s at any random oracles” rather than using the standard terminology f x x NP point , but also to provide an -proof that the value “pseudorandom functions” — the values s come “out f x s is indeed correct without compromising the unpre- of the blue,” as if from an oracle, and the receiver must sim- s f dictability of s at any other point for which no such a proof ply trust that they are computed correctly from the seed . was provided. Therefore, though quite large, the applicability of pseu- dorandom oracles is limited: for instance, to settings in which (1) the “seed owner”, and thus the one evaluating 1 Introduction the pseudorandom oracle, is totally trusted; or (2) it is to the seed-owner’s advantage to evaluate his pseudorandom oracle correctly; or (3) there is absolutely nothing for the PSEUDORANDOM ORACLES. Goldreich, Goldwasser, and seed-owner to gain from being dishonest. Micali [GGM86] show how to simulate a random ora- f x One efficient way of enabling anyone to verify that s b cle from a-bit strings to -bit strings by means of a con- f x really is the value of pseudorandom oracle s at point struction using a seed, that is, a secret and short random clearly consists of publicizing the seed s. However, this string. They show that, if pseudorandom generators exist f will also destroy the unpredictability of s : anyone could [BM84, Yao82], then there exists a polynomial-time algo- f easily compute the value of s at any point. s rithm F such that, letting denote the seed, the func- We instead wish to provide a new type of pseudoran- def a b f F s f g f g tion s passes all effi- dom oracle. Informally, we want one in which the owner f cient statistical tests for oracles. That is, to an observer s of the seed can, as usual, evaluate s at any point, but 1 with sufficiently limited computational resources, accessing also prove (with an NP proof ) that the so obtained values a b g f g a random oracle from f to is provably indis- are indeed correct without compromising the unpredictabil- f s x tinguishable from accessing (as an oracle) , even if al- f ity of the value of s at any point for which no proof F s x gorithm is publicly known (provided that is still kept f of correctness for s is given. That is, given an input secret). x, the seed-owner should be able to produce in polynomial v f x proof time the value s together with a string ef- x THE PROBLEM OF CONSTRUCTING VERIFIABLE PSEUDO- ficiently proving that v is correct. The scheme should have RANDOM FUNCTIONS. By its very definition, a pseudoran- the property that a unique value v is provable as the value f x dom oracle `ala [GGM86] is not verifiable: without knowl- of s . We call such a mathematical object a verifiable edge of the seed (or any other additional information), upon (pseudo-)random function, VRF for brevity. z f receiving the value of a pseudorandom oracle s at point x, one cannot distinguish it from an independently selected A WEAKER SOLUTION: PSEUDORANDOM ORACLES + ZERO-KNOWLEDGE PROOFS. If interaction were allowed, Laboratory for Computer Science, MIT, Cambridge, MA 02139. VRFs could be constructed from GGM pseudorandom or- y Department of Applied Science, Harvard University, Cambridge, MA 02138. Work supported in part by NSF Contract CCR-9877138. acles via zero-knowledge proofs [GMR89] and a commit- z MIT Laboratory for Computer Science. 545 Technology Square. ment scheme. Indeed, as suggested in a signature scheme Cambridge, MA 02139. E-mail: [email protected]. of Bellare and Goldwasser [BG89], the owner of the seed URL: http://theory.lcs.mit.edu/˜salil. Supported by a 1 DOD/NDSEG fellowship and partially by DARPA grant DABT63-96-C- Strictly speaking, we actually allow “MA proofs”, since their verifi- 0018. cation may be probabilistic. s f c to a pseudorandom oracle s can publish a commitment changed. But VRFs may also be useful in settings where v to s. Whenever he wishes to prove that is the value of his the public key is provided “on the fly” to prove that vari- V oracle at a point x to a verifier , he proves in zero knowl- ous function values (given previously or at the same time) V v f x c s edge to that s and that is a commitment to . are indeed consistent with one single VRF. In case the VRF Such a statement is provable in zero knowledge because all outputs strings longer than the public key, it may even be NP statements are provable in zero knowledge [GMW91]. useful to provide the public key on the fly to prove that The trouble with such an approach is that it requires inter- a single value is consistent with some VRF, as this would action. A very efficient incarnation of this idea is given by limit the owner to relatively few choices. Naor and Reingold [NR97], but it still suffers from the need In addition to introducing this notion, we provide an ex- for interaction. plicit VRF construction, based on a variant of the RSA as- Such interaction could be removed by using noninter- sumption. Informally stated, we prove: active zero-knowledge proofs (NIZK) [BFM88, BDMP91], as done by Bellare and Goldwasser [BG89]. This ap- Main Theorem: Assume that the RSA function with proach however suffers from another drawback: noninterac- large prime exponents cannot be inverted in polyno- g tive zero-knowledge proofs presuppose that the prover and mial time. Then, there exists a VRF from f into g verifier share a bit-string that is guaranteed to be random. f . So the question is who is to select this shared random string R . Each of the possibilities has a deficiency that we wish to OVERVIEW OF THE CONSTRUCTION. We motivate our avoid in defining VRFs: construction by first discussing the relationship between 1. The seed owner selects R : If the seed owner selects the VRFs and secure signature schemes. In a signature scheme shared random string improperly, the soundness of the that is existentially unforgeable against a chosen message NIZK proof system is no longer guaranteed, so there attack [GMR88], the signature of a message x, denoted v f x may be many values that are “provable” as s . x SIG , is a value that is unpredictable (even given sig- 2. The verifier selects R : If the verifier selects the shared natures of chosen other messages), but verifiable (given the random string improperly, the zero-knowledge prop- proper public key). However, such schemes do not directly x SIG x erty of the NIZK proof system is no longer guaranteed. give rise to VRFs by setting f to be , for two f x v Thus, by proving s with respect to such an reasons: improperly chosen R , the prover may leak knowledge 1. There may be many valid signatures for a given string s f about the seed and s will “lose” its pseudorandom- x (violating the unique provability requirement). ness. x 2. SIG is only unpredictable, not necessarily pseudo- 3. The seed owner and verifier jointly select R by a “coin- random. flipping” protocol.: This requires interaction, which we wish to avoid. We begin by discussing the first deficiency, as it is the 4. A trusted third party selects R : We do not want to as- more serious one. Even though the definition does not guar- sume the existence of such a trusted third party. antee the uniqueness of signatures, one might hope that ex- isting signature schemes happen to have this property. How- ever, most known secure signature schemes are either prob- OUR SOLUTION. We propose a notion of VRF’s which abilistic or history dependent. Either property violates the needs neither interaction nor sharing a guaranteed ran- x the unique provability requirement: if we define f to be dom string. Rather, we only require that the owner of the x x SIG , there may be a multiplicity of signatures of and PK function f publish a public key , which can be viewed x thus a multiplicity of f values, all duly provable.