Re: [Cfrg] new draft specifying VRFs (verifiable random functions)

[Sharon Goldberg <[e-mail]>]

Yes that's true. See the "uniqueness"security property defined in the
draft.

It's also very important that VRF hash outputs look pseudorandom even given
knowledge of the public key. (But not given knowledge of the corresponding
proof or secret key.) That's why the RSA-FDH-VRF hash output is the Hash of
a deterministic RSA signature, not the signature itself. See the security
considerations section of the draft for more details.

Sharon

On Tuesday, March 14, 2017, Tony Arcieri <[e-mail]> wrote:

> On Tue, Mar 14, 2017 at 2:11 PM, Richard Barnes <[e-mail]
> <javascript:_e(%7B%7D,'cvml','[e-mail]');>> wrote:
>
>> Thanks for writing this up.  One quick, probably trivial question: How do
>> these VRFs differ from signature schemes?  From the API point of view, they
>> seem very similar, if you view the proof as the signature value.
>>
>
> They are similar, however VRFs are not malleable in the same way as
> signatures (VRFs guarantee a unique mapping of input to random output), and
> specifically designed so the proof can be delivered separately from the
> output (so the output can e.g. be recorded in a Merkle tree for
> timestamping/transparency purposes). The latter prevents low-entropy inputs
> from being preimaged, even if the public key and output are known to the
> attacker (but not the proof).
>
> --
> Tony Arcieri
>


-- 
Sharon Goldberg
Computer Science, Boston University
http://www.cs.bu.edu/~goldbe