vrf

Documentation

Overview

Package vrf implements a verifiable random function using the Edwards form of Curve25519, SHA3 and the Elligator map.

E is Curve25519 (in Edwards coordinates), h is SHA3.
f is the elligator map (bytes->E) that covers half of E.
8 is the cofactor of E, the group order is 8*l for prime l.
Setup : the prover publicly commits to a public key (P : E)
H : names -> E
    H(n) = f(h(n))^8
VRF : keys -> names -> vrfs
    VRF_x(n) = h(n, H(n)^x))
Prove : keys -> names -> proofs
    Prove_x(n) = tuple(c=h(n, g^r, H(n)^r), t=r-c*x, ii=H(n)^x)
        where r = h(x, n) is used as a source of randomness
Check : E -> names -> vrfs -> proofs -> bool
    Check(P, n, vrf, (c,t,ii)) = vrf == h(n, ii)
                                && c == h(n, g^t*P^c, H(n)^t*ii^c)

Index

• Constants
• func Compute(m []byte, sk *[SecretKeySize]byte) []byte
• func GenerateKey(rnd io.Reader) (pk []byte, sk *[SecretKeySize]byte, err error)
• func Prove(m []byte, sk *[SecretKeySize]byte) (vrf, proof []byte)
• func Verify(pkBytes, m, vrfBytes, proof []byte) bool

Constants

const (
	PublicKeySize = 32
	SecretKeySize = 64
	Size          = 32

	ProofSize = 32 + 32 + intermediateSize
)

Functions

func Compute

func Compute(m []byte, sk *[SecretKeySize]byte) []byte

func GenerateKey

func GenerateKey(rnd io.Reader) (pk []byte, sk *[SecretKeySize]byte, err error)

GenerateKey creates a public/private key pair. rnd is used for randomness. If it is nil, `crypto/rand` is used.

func Prove

func Prove(m []byte, sk *[SecretKeySize]byte) (vrf, proof []byte)

Prove returns the vrf value and a proof such that Verify(pk, m, vrf, proof) == true. The vrf value is the same as returned by Compute(m, sk).

func Verify

func Verify(pkBytes, m, vrfBytes, proof []byte) bool

Verify returns true iff vrf=Compute(m, sk) for the sk that corresponds to pk.