Verifiable Random Function (VRF)

The output y is computationally indistinguishable from a uniformly random string of the same length, even to an adversary who has seen many other VRF outputs.

• No Bias: An observer cannot predict any bit of the output with probability better than 1/2, even knowing the public key and all previous outputs.
• Unpredictability: The prover cannot choose or influence the output in any direction. They must execute the function honestly.
• This property is formally proven under the Decisional Diffie-Hellman (DDH) assumption in elliptic curve constructions, ensuring the randomness is as strong as the underlying cryptographic hardness problem.

Anyone holding the public key pk can verify that y is the correct output for input x without knowing the secret key sk. The proof π is non-interactive—the verifier does not need to communicate with the prover.

• Verification Algorithm: Verify(pk, x, y, π) → {0, 1} returns 1 if and only if y = VRF_sk(x).
• Soundness: A malicious prover cannot forge a proof π' that convinces a verifier to accept a false output y' ≠ VRF_sk(x).
• This enables asynchronous verification in smart contracts, where a node can submit a randomness output and proof in a single transaction for on-chain validation.

The prover generates the proof π without any interaction with the verifier or a trusted third party. This is a critical distinction from interactive randomness protocols.

• Single-Round: The prover computes (y, π) = Prove(sk, x) in one step.
• No Timing Assumptions: Unlike commit-reveal schemes, there is no window where a participant can abort after seeing others' contributions.
• This property eliminates the last-actor problem in decentralized randomness generation, where the final participant in a multi-round protocol could bias the outcome by selectively withholding their reveal.

While the proof π is publicly verifiable, the secret key sk remains hidden. The output y is deterministic for the prover but unpredictable to everyone else until revealed.

• Key Secrecy: Given pk, x, y, and π, an adversary cannot recover sk or predict VRF_sk(x') for any x' ≠ x.
• Forward Secrecy: Knowledge of past outputs does not compromise future outputs.
• This allows a node to privately determine if it has been selected as a leader before broadcasting proof of its eligibility, a pattern used in Algorand's Pure Proof-of-Stake to protect leaders from targeted denial-of-service attacks.

Verification is exponentially faster than generation. While proving requires a scalar multiplication on an elliptic curve, verification is a constant-time pairing check.

• Asymmetric Cost: Proving is O(1) elliptic curve operations; verification is typically a single bilinear pairing check.
• Batch Verification: Multiple VRF proofs can be verified simultaneously with a single pairing operation, reducing amortized cost.
• In Chainlink VRF v2, this asymmetry enables gas-efficient on-chain verification where hundreds of smart contracts can verify randomness proofs without imposing prohibitive transaction costs on the network.

VRFs are the cryptographic backbone of Proof-of-Stake (PoS) leader selection. Protocols like Algorand and DFINITY use VRFs to secretly and randomly select block proposers and committee members. Each node evaluates the VRF locally using its private key and the current epoch's seed. If the output falls below a target threshold, the node is elected. The node then broadcasts its VRF proof alongside the proposed block, allowing all other participants to instantly verify the election was fair and non-manipulable.

• Key Benefit: Prevents adversaries from predicting or targeting the next block proposer.
• Example: Algorand's Pure Proof-of-Stake uses VRFs for cryptographic sortition, achieving sub-5-second block finality.

On-chain lotteries and games require randomness that players cannot manipulate and operators cannot bias. A VRF-based lottery works by having a smart contract request randomness. The oracle network (e.g., Chainlink VRF) generates a random number and a corresponding proof, delivering both on-chain. The smart contract verifies the proof against the oracle's public key before distributing winnings.

• Security Model: Even if the oracle is compromised, it cannot forge a valid proof for a favorable outcome.
• Use Case: PoolTogether's no-loss prize savings protocol uses Chainlink VRF to select winners transparently.

Fair NFT launches require provably random trait assignment to prevent creators from reserving rare items. When a user mints an NFT, a VRF call generates a random seed on-chain. This seed deterministically maps to a set of traits via the NFT's metadata algorithm. The VRF proof is stored on-chain, allowing any third party to audit the minting process and confirm that rare traits were not artificially allocated.

• Transparency: Buyers can independently verify that trait distribution matches the advertised rarity table.
• Implementation: Bored Ape Yacht Club and similar PFP projects integrate VRF-based reveal mechanics to ensure fair distribution.

VRFs enable stealth airdrops where eligibility is proven without revealing the recipient's identity until they claim. A protocol generates a VRF output based on a user's address and a secret seed. The user can prove they are entitled to an airdrop by presenting the VRF proof, which is verified without revealing the underlying address to the public mempool until the claim transaction is submitted.

• Pattern: Combines VRFs with Merkle trees for scalable, private distribution lists.
• Advantage: Prevents front-running and protects recipient privacy during the distribution phase.

VRFs strengthen DNS Security Extensions (DNSSEC) by providing verifiable randomness for NSEC5 records. Traditional NSEC records can be walked to enumerate all domain names in a zone. NSEC5 uses a VRF to hash domain names, producing a verifiable, pseudorandom ordering. A resolver can verify the non-existence of a domain without being able to invert the VRF to discover other domain names.

• Security Property: Prevents zone enumeration attacks while maintaining cryptographic proof of denial of existence.
• Standardization: Defined in IETF RFC 9276 for privacy-preserving authenticated denial of existence.

End-to-end verifiable voting systems use VRFs to generate random challenges for risk-limiting audits. After an election, a VRF takes a public seed (e.g., a future block hash) and the auditor's private key to randomly select ballots for manual inspection. The VRF proof guarantees the selection was unbiased and unpredictable, preventing an auditor from cherry-picking favorable ballots.

• Process: The VRF output deterministically selects ballot indices, and the proof is published alongside audit results.
• Trust Model: Eliminates the need to trust a central random number generator in post-election audits.