Creative Commons Attribution 3.0 Unported license
We construct a verifiable delay function (VDF) by showing how the Rivest-Shamir-Wagner time-lock puzzle can be made publicly verifiable.
Concretely, we give a statistically sound public-coin protocol to prove that a tuple (N,x,T,y) satisfies y=x^{2^T} mod N where the prover doesn't know the factorization of N and its running time is dominated by solving the puzzle, that is, compute x^{2^T}, which is conjectured to require T sequential squarings. To get a VDF we make this protocol non-interactive using the Fiat-Shamir heuristic.
The motivation for this work comes from the Chia blockchain design, which uses a VDF as a key ingredient. For typical parameters (T <=2^{40},N=2048), our proofs are of size around 10KB, verification cost around three RSA exponentiations and computing the proof is 8000 times faster than solving the puzzle even without any parallelism.
@InProceedings{pietrzak:LIPIcs.ITCS.2019.60,
author = {Pietrzak, Krzysztof},
title = {{Simple Verifiable Delay Functions}},
booktitle = {10th Innovations in Theoretical Computer Science Conference (ITCS 2019)},
pages = {60:1--60:15},
series = {Leibniz International Proceedings in Informatics (LIPIcs)},
ISBN = {978-3-95977-095-8},
ISSN = {1868-8969},
year = {2019},
volume = {124},
editor = {Blum, Avrim},
publisher = {Schloss Dagstuhl -- Leibniz-Zentrum f{\"u}r Informatik},
address = {Dagstuhl, Germany},
URL = {https://drops.dagstuhl.de/entities/document/10.4230/LIPIcs.ITCS.2019.60},
URN = {urn:nbn:de:0030-drops-101537},
doi = {10.4230/LIPIcs.ITCS.2019.60},
annote = {Keywords: Verifiable delay functions, Time-lock puzzles}
}