Constructing Verifiable Random Functions with Large Input Spaces

Abstract

We present a family of verifiable random functions which are provably secure for exponentially-large input spaces under a non-interactive complexity assumption. Prior constructions required either an interactive complexity assumption or one that could tolerate a factor 2 n security loss for n-bit inputs. Our construction is practical and inspired by the pseudorandom functions of Naor and Reingold and the verifiable random functions of Lysyanskaya. Set in a bilinear group, where the Decisional DiffieHellman problem is easy to solve, we require the -Decisional Diffie-Hellman Exponent assumption in the standard model, without a common reference string. Our core idea is to apply a simulation technique where the large space of VRF inputs is collapsed into a small (polynomial-size) input in the view of the reduction algorithm. This view, however, is information-theoretically hidden from the attacker. Since the input space is exponentially large, we can first apply a collision-resistant hash function to handle arbitrarily-large inputs.

(Efficient) Universally Composable Oblivious Transfer Using a Minimal Number of Stateless Tokens

“…A signature scheme is called unique if for every possible public key vk and every message m, there is at most one signature σ such that Vrfy vk (m, σ) = 1. Various constructions of such schemes based on number-theoretic assumptions are known [46,19,1,35,33].…”

Relation between Verifiable Random Functions and Convertible Undeniable Signatures, and New Constructions

“…This result, coupling with our zero-knowledge protocols for generalized DDH and non-DDH, then yields several efficient SCUS schemes. We give in Sect.4.2 two concrete deterministic SCUS schemes denoted as SCUS DY and SCUS HW , respectively based on the VRFs of Dodis, Yampolskiy [9] and Hohenberger, Waters [13]. We note that SCUS DY requires small signing space, while SCUS HW does not.…”

“…SCUS from the VRF of Hohenberger and Waters [13] The VRF also works on a pairing group PG = (G, G T , g, q, e), and is pseudo-random under the q-DDHE assumption. The secret key is sk = (ũ, u 0 , .…”

Efficient Signatures of Knowledge and DAA in the Standard Model

“…To construct a LIT which is not only weakly indistinguishable and which supports large domains, a natural approach would be to consider large-domain VRFs. There have been several such schemes in the recent literature including the cascade construction of Boneh et al [12] to increase the domain of the Dodis-Yampolskiy VRF [29], the BCKL construction [2] applied to the Dodis-Yampolskiy VRF [29] and the Hohenberger-Waters VRF [38]. Unfortunately, all of the abovementioned schemes violate the weak linkability requirement for LITs, as it is easy to find for example sk 0 = sk 1 and m such that LITTag(sk 0 , m) = LITTag(sk 1 , m).…”