I'm looking for a set of pairing product equations (ala Groth-Sahai) which allow a prover to prove that the output of a VRF is in a specific range.

In the E-cash system in [BCKL] there is a construction of VRF which basically outputs a weak Boneh-Boyen signature. But this signature is a group element in source group 1 ($\mathbb{G}_1$).

Is there a way to "transform/encode" the output as an element in $\mathbb{Z}_p$ and subsequently prove that it falls in a specific range (using the an approach like CCS08)?

  • $\begingroup$ What do you mean by "range" in $\mathbb{G}_1$? $\endgroup$
    – Ievgeni
    May 21 at 13:18
  • $\begingroup$ AFAIK the output of the [BCKL]-VRF is a pseudorandom element $y\in\mathbb{G_1}$. The goal is to interpret this element, $y$, as an integer or a bit-string in order to subsequently prove that the random element is in a specific range (say $0\leq y<H$). Alternatively find another VRF construction that lends itself well to GS but outputs (directly) $y\in Z_p$. $\endgroup$ May 23 at 8:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.