Skip to main content
7 of 15
added 123 characters in body
knaccc
  • 4.8k
  • 1
  • 16
  • 32

To make a simplification, the ECVRF described in draft-irtf-cfrg-vrf-02 will use a key-pair $(x, Y=xG)$ and take an input $\alpha$. It will return $P = xH$, where $H = H_p(Y \mathbin\|\alpha)$, along with a Schnorr-based discrete-log-equivalence (DLeq) proof demonstrating that $P$ shares the same private key $x$ with $Y$ on generator points $H$ and $G$ respectively. This therefore proves that $P$ was correctly calculated as $xH$. $H_p()$ means to create a hash resulting in an EC point, which is what the linked document refers to as $\texttt{ECVRF_hash_to_curve}$. $G$ refers to a well-known base point for the curve.

You can create a modified $\texttt{ECVRF_prove}$ function for the purposes of generating a commitment. It will pick a random blinding factor $b$, and will return $P' = x(H+bG)$ instead of $P = xH$. It will return a DLeq proof that will demonstrate that $P'$ shares the same private key $x$ with $Y$ on generator points $(H+B)$ and $G$ respectively, and thus prove that $P'$ has been calculated as expected. It will additionally return $B = bG$ and a regular Schnorr signature for $B$ in order to demonstrate that the point $B$ was created using the generator point $G$.

A modified $\texttt{ECVRF_verify}$ function will be created to verify the commitment. It will take $B$ as an additional argument, so that it can verify that the DLeq proof operates with the generator $(H+B)$ instead of $H$.

After this modified verification, it is known for sure that $P' = x(H+B) = xH + xB$. Since $x$ is private, the verifier cannot calculate $xB$ in order to determine the committed value $xH$. This also means it's impossible for a verifier to try to discover whether this is a commitment to any specific $xH$ value.

The commitment is opened by revealing $xB$ and providing a DLeq proof that $xB$ and $Y$ share the same private key $x$ on the generator points $B$ and $G$ respectively. Because it has already been proven that $B$ was created with the generator point $G$, the prover cannot cheat and change the value $xH$ when opening the commitment (because the discrete log of $H$ w.r.t. $G$ is unknowable due to the implementation of the $H_p()$ function).

The $xH$ value which was committed to will be identical to the $xH$ value that would have been produced by the original unmodified $\texttt{ECVRF_prove}$ function.

knaccc
  • 4.8k
  • 1
  • 16
  • 32