SESSION 3C-2 RandRunner: Distributed Randomness from Trapdoor VDFs with Strong Uniqueness Generating randomness collectively has been a long standing problem in distributed computing. It plays a critical role not only in the design of state-of-the-art Byzantine fault-tolerant (BFT) and blockchain protocols, but also for a range of applications far beyond this field. We present RandRunner, a random beacon protocol with a unique set of guarantees that targets a realistic system model. Our design avoids the necessity of a (BFT) consensus protocol and its accompanying high complexity and communication overhead. We achieve this by introducing a novel extension to verifiable delay functions (VDFs) in the RSA setting that does not require a trusted dealer or distributed key generation (DKG) and only relies on well studied cryptographic assumptions. This design allows RandRunner to tolerate adversarial or failed leaders while guaranteeing safety and liveness of the protocol despite possible periods of asynchrony.

1. RandRunner: Distributed Randomness from
Trapdoor VDFs with Strong Uniqueness
Philipp Schindler*
, Aljosha Judmayer, Markus Hittmeir,
Nicholas Stifter, Edgar Weippl
NDSS 2021
SBA Research, Universität Wien, TU Wien

2. 2
Verifiable Delay Functions (VDFs)
Verify
Setup
Eval

3. 3
Verifiable Delay Functions (VDFs)
Verify
Setup pp
Eval

4. 4
Verifiable Delay Functions (VDFs)
Verify
Setup
X
Y
pp
Eval

5. 5
Verifiable Delay Functions (VDFs)
Verify
Setup
X
Y
pp
Eval
T

6. 6
Verifiable Delay Functions (VDFs)
Verify
Setup
X
Y
pp
Eval
T
π

7. 7
Verifiable Delay Functions (VDFs)
Verify
Setup
X
Y
pp
π
Eval
a
c
c
e
p
t
T

8. 8
≠
Verifiable Delay Functions (VDFs)
Verify
Setup
X
Y
pp
π
Eval
Y'
≠
r
e
j
e
c
t
T
π'

9. 9
Trapdoor VDFs
Setup
X
Y
pp
T
π
Eval
Trapdoor VDFs

10. 10
Trapdoor VDFs
Setup
X
Y
pp
T
π
Eval
Trapdoor VDFs
sk

11. 11
Trapdoor VDFs
Setup
X
Y
pp
T
π
Eval
Trapdoor VDFs
TrapdoorEval
X
Y
π
sk

12. 12
Trapdoor VDFs with Strong
Uniqueness
TrapdoorEval
pp
T
X
Y
π
sk
Verify
Y'
≠
pp
r
e
j
e
c
t
π'
≠

13. 13
A Randomness Beacon
A (distributed) service which produces a sequence of "random"
integers in regularly spaced time intervals. (see, e.g., Rabin, 1983)

14. 14
A Randomness Beacon
A (distributed) service which produces a sequence of "random"
integers in regularly spaced time intervals. (see, e.g., Rabin, 1983)
243f6a8885a308d313198a2e03707344

15. 15
A Randomness Beacon
A (distributed) service which produces a sequence of "random"
integers in regularly spaced time intervals. (see, e.g., Rabin, 1983)
243f6a8885a308d313198a2e03707344
e3b0c44298fc1c149afbf4c8996fb924

16. 16
A Randomness Beacon
A (distributed) service which produces a sequence of "random"
integers in regularly spaced time intervals. (see, e.g., Rabin, 1983)
243f6a8885a308d313198a2e03707344
e3b0c44298fc1c149afbf4c8996fb924
5533c9578fb6aace040b0dfe0d446413

17. 17
A Randomness Beacon
A (distributed) service which produces a sequence of "random"
integers in regularly spaced time intervals. (see, e.g., Rabin, 1983)
243f6a8885a308d313198a2e03707344
e3b0c44298fc1c149afbf4c8996fb924
5533c9578fb6aace040b0dfe0d446413
a3a4299f6ea4911d9b5fafeb765a0db6

18. 18
A Randomness Beacon
A (distributed) service which produces a sequence of "random"
integers in regularly spaced time intervals. (see, e.g., Rabin, 1983)
243f6a8885a308d313198a2e03707344
e3b0c44298fc1c149afbf4c8996fb924
5533c9578fb6aace040b0dfe0d446413
a3a4299f6ea4911d9b5fafeb765a0db6
…
What do we mean by "random"?
Are these values really "random"?

19. 19
Desired Properties
?
Bias-Resistance
Scalability
Unpredictability Liveness
Public-Verifiability
Energy Efficiency
Guaranteed Output Delivery

20. 20
VDF based Randomness Beacons
A "chained" approach
VDF R
pp
1
R0 VDF R2 ...
VDF

21. 21
Desired Properties
?
Bias-Resistance
Unpredictability
Public-Verifiability
Guaranteed Output Delivery
Scalability
Liveness
Energy Efficiency

22. 22
RandRunner (Setup)
pp1
Setup
pp2
Setup
pp3
Setup

23. 23
RandRunner (Structural View)
pp1
pp2
T-VDF R1
R0 T-VDF R2 ...
T-VDF
pp3
round 1 round 2 round 3

24. 24
A Round in RandRunner
Leader
use trapdoor to quickly evaluate
the VDF
broadcast result to everyone
Other Nodes
obtain the leader's VDF output by
in parallel:
• evaluating the leader's VDF
(without trapdoor)
• waiting from an incoming
message
send / forward result

25. 25
RandRunner (Execution Example)

26. 26
RandRunner (Execution Example)

27. 27
RandRunner (Execution Example)

28. 28
RandRunner (Execution Example)

29. 29
RandRunner (Execution Example)

30. 30
RandRunner (Execution Example)

31. 31
RandRunner (Execution Example)

32. 32
RandRunner (Execution Example)

33. 33
Unpredictability (RandRunner-RS)

34. 34
Unpredictability (RandRunner-RS)

35. 35