I am very new to the topic, I found it out only today afternoon, so forgive the dumbness of the question should that be the case.

I have tried to grasp the rationale of Verifiable Delayed Functions (whatched all the videos, read all articles), used in many blockchain-related applications. I understand that the 2 properties that the functions need to fulfil are the following:

  • Sequential: you cannot know the output until you first executed all the necessary steps
  • Efficiently verifiable: after the function has been computed on an input x, it should be fast to verify that the output y came from executing the VDF on x

Now, the part I don't get is: why should it be efficient? Taking for instance the example of the Random Beacon use case:

  • A,B,C,D,E submit a random value
  • A random beacon has to be derived from this random value
  • We need to avoid that E can manipulate the output of the random value by means of its input, brute-forcing the desired output with many inputs with its incredible parallel CPU power

If a VDF that is not efficient is used, wouldn't the conditions still be met?

  • A,B,C,D,E submit random value
  • E needs 1 hour to calculate each single output sequentially, so it cannot really brute force anything
  • Meantime the random beacon is calculated and broadcasted
  • Whoever needs to use it, will take another hour to verify it. Annoying, but still feasible.

I understand that this makes everything extremely slow, but is that the only reason to have the efficiency as a hard requirement? Or are there motivations such that the applications would be actually impaired/unsecure? I bet it's the second one, but why?

  • $\begingroup$ In theory, it isn't absolutely necessary that verification be fast. But the usual application is a client authenticating with a server. We want to impose some minimum amount of delay on the client, to make a brute-force attack thoroughly impractical. If, however, it imposes a substantial extra load on the server, system administrators (and such) are likely to reject it. $\endgroup$ Feb 26, 2021 at 22:07
  • $\begingroup$ Are you saying if it takes 1 hour to construct a VDF random value and it should take 1 hour to verify the correctness of the VDF random value (proof verification)? $\endgroup$ Jun 23, 2021 at 6:11


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.