Continuous Verifiable Delay Functions

Ephraim, Naomi; Freitag, Cody; Komargodski, Ilan; Pass, Rafael

doi:10.1007/978-3-030-45727-3_5

Cited by 47 publications

(24 citation statements)

References 32 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…VDFs were first introduced by Boneh et al [6] in 2018, and have since received increased attention from other researchers (see, e.g., [6], [46], [39], [7], [20], [32], [44], [25], [24], [34]). As introduced by Boneh et al [6], [7], a VDF is a function f : X → Y which maps every input x ∈ X to an unique output y ∈ Y. Computing the VDF is sequential in the sense that it takes a prescribed amount of time, whether or not it is executed on multiple processors.…”

Section: A Backgroundmentioning

confidence: 99%

RandRunner: Distributed Randomness from Trapdoor VDFs with Strong Uniqueness

Schindler

Judmayer

Hittmeir

et al. 2021

Proceedings 2021 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Generating randomness collectively has been a long standing problem in distributed computing. It plays a critical role not only in the design of state-of-the-art Byzantine faulttolerant (BFT) and blockchain protocols, but also for a range of applications far beyond this field. We present RandRunner, a random beacon protocol with a unique set of guarantees that targets a realistic system model. Our design avoids the necessity of a (BFT) consensus protocol and its accompanying high complexity and communication overhead. We achieve this by introducing a novel extension to verifiable delay functions (VDFs) in the RSA setting that does not require a trusted dealer or distributed key generation (DKG) and only relies on well studied cryptographic assumptions. This design allows RandRunner to tolerate adversarial or failed leaders while guaranteeing safety and liveness of the protocol despite possible periods of asynchrony.

show abstract

Section: A Backgroundmentioning

confidence: 99%

RandRunner: Distributed Randomness from Trapdoor VDFs with Strong Uniqueness

Schindler

Judmayer

Hittmeir

et al. 2021

Proceedings 2021 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

“…Regarding PPAD hardness, another line of beautiful works [45,55,56,64,92,104] showed that the hardness of #SAT reduces to that of PPAD, assuming the adaptive soundness of applying Fiat-Shamir to certain protocols. Most recently, this led to basing the PPAD hardness on that of #SAT and the sub-exponential LWE assumption [92].…”

Section: Corollary 13 (Informal)mentioning

confidence: 99%

Indistinguishability obfuscation from well-founded assumptions

Jain

Lin

Sahai

2021

Proceedings of the 53rd Annual ACM SIGACT Symposium on Theory of Computing

155

View full text Add to dashboard Cite

Indistinguishability obfuscation, introduced by [Barak et. al. Crypto 2001], aims to compile programs into unintelligible ones while preserving functionality. It is a fascinating and powerful object that has been shown to enable a host of new cryptographic goals and beyond. However, constructions of indistinguishability obfuscation have remained elusive, with all other proposals relying on heuristics or newly conjectured hardness assumptions.In this work, we show how to construct indistinguishability obfuscation from subexponential hardness of four well-founded assumptions. We prove: Informal Theorem: Let 𝜏 ∈ (0, ∞), 𝛿 ∈ (0, 1), 𝜖 ∈ (0, 1) be arbitrary constants. Assume sub-exponential security of the following assumptions:-the Learning With Errors (LWE) assumption with subexponential modulus-to-noise ratio 2 𝑘 𝜖 and noises of magnitude polynomial in 𝑘, where 𝑘 is the dimension of the LWE secret, -the Learning Parity with Noise (LPN) assumption over general prime fields Z 𝑝 with polynomially many LPN samples and error rate 1/ℓ 𝛿 , where ℓ is the dimension of the LPN secret, -the existence of a Boolean Pseudo-Random Generator (PRG) in NC 0 with stretch 𝑛 1+𝜏 , where 𝑛 is the length of the PRG seed, -the Decision Linear (DLIN) assumption on symmetric bilinear groups of prime order. Then, (subexponentially secure) indistinguishability obfuscation for all polynomial-size circuits exists. Further, assuming only polynomial security of the aforementioned assumptions, there exists collusion resistant public-key functional encryption for all polynomial-size circuits. CCS CONCEPTS• Theory of computation → Cryptographic primitives.

show abstract

“…Another related concept is verifiable delay functions [14,25], in which a sequential function is evaluated over some input and takes at least t time steps to be completed, while verifying the correctness of the output is much more efficient. Similar to time-lock puzzles, VDFs are about ensuring a given bound on the computation delay is satisfied (and that parallelism is not effective in attacking the scheme) rather than the amount of computation.…”

Section: Related Workmentioning

confidence: 99%

Gage MPC: Bypassing Residual Function Leakage for Non-Interactive MPC

Almashaqbeh¹,

Benhamouda²,

Han

et al. 2021

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

Existing models for non-interactive MPC cannot provide full privacy for inputs, because they inherently leak the residual function (i.e., the output of the function on the honest parties’ input together with all possible values of the adversarial inputs). For example, in any non-interactive sealed-bid auction, the last bidder can figure out what was the highest previous bid. We present a new MPC model which avoids this privacy leak. To achieve this, we utilize a blockchain in a novel way, incorporating smart contracts and arbitrary parties that can be incentivized to perform computation (“bounty hunters,” akin to miners). Security is maintained under a monetary assumption about the parties: an honest party can temporarily supply a recoverable collateral of value higher than the computational cost an adversary can expend. We thus construct non-interactive MPC protocols with strong security guarantees (full security, no residual leakage) in the short term. Over time, as the adversary can invest more and more computational resources, the security guarantee decays. Thus, our model, which we call Gage MPC, is suitable for secure computation with limited-time secrecy, such as auctions. A key ingredient in our protocols is a primitive we call “Gage Time Capsules” (GaTC): a time capsule that allows a party to commit to a value that others are able to reveal but only at a designated computational cost. A GaTC allows a party to commit to a value together with a monetary collateral. If the original party properly opens the GaTC, it can recover the collateral. Otherwise, the collateral is used to incentivize bounty hunters to open the GaTC. This primitive is used to ensure completion of Gage MPC protocols on the desired inputs. As a requisite tool (of independent interest), we present a generalization of garbled circuit that are more robust: they can tolerate exposure of extra input labels. This is in contrast to Yao’s garbled circuits, whose secrecy breaks down if even a single extra label is exposed. Finally, we present a proof-of-concept implementation of a special case of our construction, yielding an auction functionality over an Ethereum-like blockchain.

show abstract

Continuous Verifiable Delay Functions

Cited by 47 publications

References 32 publications

RandRunner: Distributed Randomness from Trapdoor VDFs with Strong Uniqueness

RandRunner: Distributed Randomness from Trapdoor VDFs with Strong Uniqueness

Indistinguishability obfuscation from well-founded assumptions

Gage MPC: Bypassing Residual Function Leakage for Non-Interactive MPC

Contact Info

Product

Resources

About