Verifiable delay functions vs Proof of Sequential Work

Question

I've read recent papers about verifiable delay functions (Boneh et al 2018) and proof of sequential works (Cohen et al. 2018). I understand that the core difference between the definitions is that a VDF output is required to be unique (while in PoSW constructions - many commitments can prove knowledge of the same x w.h.p.).

But... why does it matter? Namely, what are the applications that use VDF, and that rely heavily on this uniqueness property such that replacing the VDF with the PoSW won't suffice?

For example, the Randomness Beacon - one of the basic motivations for VDF, can use PoSW as well, no?

Answer 1

A typical thing which you cannot do with a proof of sequential work is achieving time-lock encryption. In time lock encryption, you want the user to be able to retrieve the hidden message only after some time (i.e., you want to "send a message to the future", as its inventors initially put it). With a VDF, you can use the unique secret to mask the secret message $m$ which you want to send to the future; with a proof of sequential work, there is no clear way of masking a message such that retrieving it requires solving the puzzle (except in an interactive way, where another party checks the proof of sequential work and send $m$ if the check passes).

See also the discussion page 23 of this paper: proofs of sequential work fail to replace timed commitments in protocols that seek to achieve fairness. I believe that VDFs, on the other hand, can be used here, since they do not suffer from the limitation that prevents proofs of sequential work to be usable here - namely, that one can lie to the verifier about what was the solution to the puzzle we solved, even though one must still invest a given amount of sequential work to solve the puzzle in the first place. With VDFs, you cannot lie this way.

Answer 2

The randomness beacon critically relies on the uniqueness (or function) property of VDFs. As you said a PoSW can have multiple output. A malicious prover would select the PoSW output that yields her the best beacon. This would bias the beacon.