Intuitively, it seems that the hash of a BLS signature could be used as a VRF as well. In a nutshell,
BLS-Signature is the VRF output and the verification first checks the signature is valid, and then compute the hash over it to provide the VRF output. (Or similarly, one can provide
H(BLS-Signature) as the VRF output and
BLS-Signature as the VRF proof.)
- Is this scheme a VRF ? Given a collision resistant hash function of course.
- How would one would go about proving it ?