Re: [Cfrg] I-D Action: draft-irtf-cfrg-vrf-06.txt

[Jeff Burdges <[e-mail]>]

We’ve had an internal discussion about whether VRF proving should be called VRF signing.  I think existing literature is rather evenly divided on this point, well depending upon how far back you go.  ;)

I think “prove” gets used when authors from the theory side want to stress the similarity with hash functions.  Implementors write “sign” to stress that their VRF either works like a signature scheme, or even was made miss-use resistant similarly to signature schemes, ala https://www.signal.org/docs/specifications/xeddsa/

I personally use dleq_prove for Schnorr DLEQ proofs because the absence of a key pair makes them tricky to use correctly, but use vrf_sign for Schnorr VRFs because done well they wind up as missuse resistant as a Schnorr signature.  I write VRF signature and VRF output in protocol descriptions.

There is another question about the relationship between the various VRF properties and the signature scheme security assumptions, although not sure if this draft is the place to make the distinctions and prove any equivalences.  Intuitively, you do want a scheme that is both a VRF and a signature more often than this draft lets on.

Also, VRFs based on Schnorr DLEQ proofs should include an extra message field because applications need to authenticate the message that carries the VRF output, like a block in Ouroboros Praos.  We needed this extra message field in the ring VRF in our new Sassafras SSLE protocol, either that or make annoying usage of FO.  You can do this with delinearization, but that’s less efficient.

Jeff



> On 11 Feb 2020, at 18:13, [e-mail] wrote:
> 
> 
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Crypto Forum RG of the IRTF.
> 
>        Title           : Verifiable Random Functions (VRFs)
>        Authors         : Sharon Goldberg
>                          Leonid Reyzin
>                          Dimitrios Papadopoulos
>                          Jan Vcelak
> 	Filename        : draft-irtf-cfrg-vrf-06.txt
> 	Pages           : 43
> 	Date            : 2020-02-11
> 
> Abstract:
>   A Verifiable Random Function (VRF) is the public-key version of a
>   keyed cryptographic hash.  Only the holder of the private key can
>   compute the hash, but anyone with public key can verify the
>   correctness of the hash.  VRFs are useful for preventing enumeration
>   of hash-based data structures.  This document specifies several VRF
>   constructions that are secure in the cryptographic random oracle
>   model.  One VRF uses RSA and the other VRF uses Eliptic Curves (EC).
> 
> 
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-irtf-cfrg-vrf/
> 
> There are also htmlized versions available at:
> https://tools.ietf.org/html/draft-irtf-cfrg-vrf-06
> https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-vrf-06
> 
> A diff from the previous version is available at:
> https://www.ietf.org/rfcdiff?url2=draft-irtf-cfrg-vrf-06
> 
> 
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
> 
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
> 
> _______________________________________________
> Cfrg mailing list
> [e-mail]
> https://www.irtf.org/mailman/listinfo/cfrg