Does anyone know of any VDF, that can be calculated by someone holding some private key in t sequential steps and is quickly verifiable in exponentially reduced step by anyone using some public key and the proof that does not leak the key ? Like opposite of RSA timelock question. A link to some paper would help. can someone tag vdf, posw and blockchain in it? I don't yet have privileges.


1 Answer 1


A Survey of two verifiable delay functions authored by Dan Boneh, Benedikt Bunz and Ben Fisch is the best resource for understanding the most promising implementations of VDFs. It is a succinct review of two recent beautiful Verifiable Delay Functions, one due to Pietrzak and the other due to Wesolowski.

There are currently three candidate constructions that satisfy the VDF requirements. Each one has its own potential downsides. The first was outlined in the original VDF paper by Boneh, et al. and uses injective rational maps. However, evaluating this VDF requires a somewhat large amount of parallel processing, leading the authors to refer to it as a “weak VDF.” Later, Pietrzak and Wesolowski independently arrived at extremely similar constructions based on repeated squaring in groups of unknown order.

The security of Pietrzak’s scheme relies on the the security of the low order assumption: it is computationally infeasible for an adversary to find an element of low order in the group being used by the VDF. The Wesolowski scheme assumes the existence of groups that satisfy something called the adaptive root assumption, which is not well studied in the mathematical literature.

Recently, Starkware, the Cryptography Engineering firm led by Eli Ben Sasson has come up with a VDF service known as Veedo, deployed on Ethereum TestNet and MainNet. Please find the details in the following post.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.