Re: [Cfrg] draft-goldbe-vrf: Verifiable Random Functions

[Tony Arcieri <[e-mail]>]

On Fri, Jul 21, 2017 at 9:32 AM, Dan Brown <[e-mail]> wrote:

> Answering myself below: VRFs have been around since 1999, so are not so
> new.  ‎Still don't like the name, and still have trouble seeing the value.
>

VRFs provide deterministic precommitments you can reveal at a later time.
This is useful if you want to maintain a 1:1 mapping of low entropy inputs
(e.g. names, email addresses, phone numbers) to some random values you can
commit to in advance, e.g. through a timestamping service/transparency log.

Using a VRF means you can make these random outputs effectively public
without them being subject to a preimage attack (so long as the VRF private
key is not leaked). This way a key transparency server can prove a given
user's keys were included in a transparency log without enabling spammers
to obtain all of the names in the directory.

-- 
Tony Arcieri