# Can we use BLS as a VRF?

Intuitively, it seems that the hash of a BLS signature could be used as a VRF as well. In a nutshell, BLS-Signature is the VRF output and the verification first checks the signature is valid, and then compute the hash over it to provide the VRF output. (Or similarly, one can provide H(BLS-Signature) as the VRF output and BLS-Signature as the VRF proof.)

1. Is this scheme a VRF ? Given a collision resistant hash function of course.
2. How would one would go about proving it ?

This works because BLS signatures are unique. Fix a pairing $$e\colon G_1 \times G_2 \to G_T$$ on groups $$G_1$$ and $$G_2$$ of prime order. For any fixed $$A \in G_2$$, the homomorphism $$\phi_A\colon \sigma \to e(\sigma, A)$$ is an injection (or the system is trivially insecure) because $$G_1$$ has prime order. Let $$B \in G_2$$ be the standard base point. A putative signature $$\sigma \in G_1$$ under public key $$P \in G_2$$ on a message $$m$$ satisfies the signature equation $$e(H(m),P) = e(\sigma,B) = \phi_B(\sigma).$$ Since $$\phi_B$$ is an injection, there is at most one possible signature $$\sigma$$ for any public key $$P$$ and any message $$m$$.
• @Nikkolasg BLS brings unpredictability and uniqueness; the random oracle brings uniformity of the output. No matter what public key you choose (as long as it is a valid public key in $G_2$), there is at most one signature $\sigma$ for each message $m$, and $H(\sigma)$ is an independent uniform random bit string for each $\sigma$. (Maybe use $H(\text{‘message’} \mathbin\| m)$ and $H(\text{‘output’} \mathbin\| \sigma)$ if you're using the same hash function $H$ for the signature's message hash and the VRF's output hash.) – Squeamish Ossifrage Oct 18 '19 at 13:42
• (It may also be prudent to hash the public key in too: $H(\text{‘message’} \mathbin\| P \mathbin\| m)$, $H(\text{‘output’} \mathbin\| P \mathbin\| \sigma)$. This is a cheap measure that may be helpful to mitigate the impact of multi-target attacks and perhaps more exotic scenarios where the adversary knows a relation between two public keys but not what the two public keys are a priori.) – Squeamish Ossifrage Oct 18 '19 at 13:48
• The output of a random oracle on inputs that an adversary cannot predict (like a signature on a message) is uniformly distributed, and consequently indistinguishable from uniform random—that's the really easy part that works for any signature scheme! Uniqueness, which has to be proven specifically for BLS since the standard notion of security doesn't entail uniqueness, holds for any public key in $G_2$. That is, there is no public key in $G_2$ for which uniqueness fails to hold. – Squeamish Ossifrage Oct 18 '19 at 21:45