VRF: Verifiable Random Function

Verifiable Random Function using Ed25519 curve.

Protocol

Setup: Secret key x, public key g^x

Prove (input α):

1. h = H1(α) and γ = h^x
2. Choose random k
3. c = H3(g, h, g^x, γ, g^k, h^k)
4. Let s = k - cx mod q.
5. Output:
   1. VRF output β = H2(γ)
   2. VRF proof π = (γ, c, s)

Verify (input α, proof π = (γ, c, s), public key g^x):

1. u = (g^x)^c ⋅ g^s

   Note, if everything is correct:

   $$u = (g^x)^c ⋅ g^s = g^xc ⋅ g^{k - cx} = g^xc ⋅ g^k ⋅ (g^{cx})^{-1} = g^k$$

2. h = H1(α) and v = γ^c ⋅ h^s

   Note, if everything is correct:

   $$v = γ^c ⋅ h^s = γ^c ⋅ h^{k - cx} = γ^c ⋅ h^k ⋅ (h^{cx})^{-1} = γ^c ⋅ h^k ⋅ (γ^c)^{-1} = h^k$$

3. Check: c = H3(g, h, g^x, γ, u, v)

4. Output: β = H2(γ)

Usage

cargo run --release
cargo test --release