VDF (Verifiable Delay Function)

What Is a Verifiable Delay Function?

A verifiable delay function (VDF) is a cryptographic function that takes a prescribed amount of time to compute, even on the fastest hardware with unlimited parallelism, but produces an output that anyone can verify quickly. The concept was formalized in 2018 by Dan Boneh, Joseph Bonneau, Benedikt Bünz, and Ben Fisch at Stanford, building on earlier work on time-lock puzzles by Rivest, Shamir, and Wagner from 1996.

The core insight is that some mathematical operations are inherently sequential: each step depends on the result of the previous step, so no amount of additional processors can speed up the computation. A VDF exploits this property to create a provable "proof of elapsed time" that is both deterministic and publicly verifiable.

VDFs differ from proof of work in a fundamental way. Proof of work is a race that can be parallelized: more miners means a faster expected solution. A VDF cannot be accelerated through parallelism. Where proof of work proves that aggregate computational effort was expended, a VDF proves that a specific amount of wall-clock time has passed.

How It Works

A VDF is formally defined as three algorithms: Setup, Eval, and Verify.

1. Setup generates public parameters, including a time parameter T that determines the minimum number of sequential steps required
2. Eval takes an input x and computes the output y along with a proof pi. This step requires T sequential operations and cannot be meaningfully parallelized
3. Verify takes the input x, output y, and proof pi, then checks correctness. Verification runs in time proportional to log(T), creating an exponential gap between evaluation and verification

The most widely used VDF construction is repeated squaring in a group of unknown order. Given an input x, the evaluator computes y = x^2T by performing T sequential modular squarings: x → x² → x⁴ → x⁸ → ... → x^2T. Each squaring depends on the previous result, enforcing sequentiality.

Groups of Unknown Order

The security of repeated-squaring VDFs depends on working in a group where the order (total number of elements) is unknown. If the order were known, an evaluator could use modular exponentiation shortcuts to compute the result far faster than T steps.

Two types of groups provide this property:

• RSA groups: the integers modulo N where N = p × q for large primes p and q. The group order depends on knowing the factorization of N, which requires a trusted setup ceremony where multiple parties jointly generate N without any single party learning p or q
• Class groups of imaginary quadratic fields: defined by a large negative discriminant D. The group order is computationally infeasible to determine, even for the party who chose D. This eliminates the trusted setup requirement entirely, though class group security is less well studied than RSA

Proof Constructions

Computing the VDF is only half the problem. The evaluator must also produce a short proof that the output is correct. Two main proof constructions exist:

Wesolowski's proof (2018): after computing y, the prover receives a random prime challenge l. The prover computes pi = x^⌊2T/l⌋, and the verifier checks that pi^l · x^r = y where r = 2^T mod l. The proof is a single group element, and verification requires only two exponentiations regardless of T.

Pietrzak's proof (2018): uses a recursive halving protocol where the prover demonstrates knowledge of intermediate values at the midpoint, quarter-point, and so on. The proof contains log₂(T) group elements, making it larger than Wesolowski's, but it relies on a weaker security assumption (the low-order assumption rather than the adaptive root assumption).

Pseudocode Example

A simplified illustration of VDF evaluation using repeated squaring:

// VDF Evaluation: repeated squaring in a group of unknown order
function vdf_eval(x, T, N):
    y = x
    for i in 1..T:
        y = (y * y) mod N    // each step depends on the previous
    proof = generate_proof(x, y, T, N)
    return (y, proof)

// VDF Verification: runs in O(log T), not O(T)
function vdf_verify(x, y, proof, T, N):
    return check_proof(x, y, proof, T, N)  // exponentially faster

Use Cases

Unbiasable Randomness Beacons

The primary application of VDFs is generating randomness that no participant can manipulate. In systems like Ethereum's RANDAO, each validator contributes entropy to a shared random seed. The problem: the last validator to contribute can see all prior contributions and selectively withhold their block to bias the outcome.

A VDF applied to the combined entropy output eliminates this attack. Because the VDF takes a prescribed time to compute, no validator can learn the final random value fast enough to decide whether to withhold. By the time anyone could evaluate the VDF, the commitment window has closed. This produces randomness that is unbiasable as long as at least one honest participant contributes entropy.

Fair Leader Election

In proof-of-stake systems, selecting which validator proposes the next block must be both random and unpredictable. If validators can predict their future selection, they can prepare attacks or strategically time transactions. VDF-based leader election ensures that the selection process cannot be gamed because the randomness underlying it cannot be computed in advance.

Time-Release Encryption

VDFs enable encryption where a message can only be decrypted after a specific duration. Applications include sealed-bid auctions (bids cannot be opened until the auction closes), electronic voting (votes remain private until tallying begins), and timed financial commitments. The message is encrypted under a key derived from a VDF output, and no one can recover the key faster than the VDF's prescribed evaluation time.

Blockchain Consensus

Chia Network uses VDFs as a core component of its consensus mechanism, combining Proof of Space with Proof of Time. Specialized nodes called "timelords" continuously evaluate VDFs using class groups of imaginary quadratic fields with 1024-bit discriminants. Chia's approach uses Wesolowski proofs split into multiple phases: fast n-Wesolowski proofs provide initial confirmation, while compact 1-Wesolowski proofs replace them once computed. This design avoids both the energy waste of proof of work mining and the capital concentration risks of pure proof of stake.

VDFs vs. Related Primitives

VDFs are often confused with related cryptographic tools. Understanding the distinctions clarifies when each is appropriate:

A verifiable random function (VRF) produces verifiable pseudorandom output instantly using a secret key, while a VDF produces verifiable output slowly using only public inputs. VRFs prove who computed the output; VDFs prove that sufficient time elapsed during computation.

Ethereum's VDF Plans

The Ethereum Foundation invested significantly in VDF research through the VDF Alliance, a collaboration with Protocol Labs (Filecoin), the Interchain Foundation (Cosmos), and the Tezos Foundation. The alliance funded development of open-source VDF ASIC hardware through Supranational to establish a known speed baseline for calibrating VDF time parameters.

The original goal was to add a VDF to Ethereum's RANDAO randomness beacon, making it resistant to last-revealer manipulation. However, as of 2026, VDFs have been deprioritized on Ethereum's roadmap. The challenges proved substantial: ASIC development is expensive, RSA-based VDFs require trusted setup ceremonies, and quantum computing threatens the underlying assumptions. Ethereum's current roadmap prioritizes quantum readiness and privacy improvements instead.

Risks and Considerations

Trusted Setup Requirements

RSA-based VDFs require a trusted setup ceremony to generate the modulus N without any party learning its factorization. If the setup is compromised (any participant learns p and q), they can compute the VDF output instantly, breaking all security guarantees. Class group-based VDFs avoid this requirement, which is why Chia chose them, but class group security assumptions are less mature.

Hardware Acceleration

The security of a VDF depends on accurately calibrating the time parameter T to the fastest possible hardware. If an adversary builds or acquires an ASIC that performs modular squaring significantly faster than expected, they can evaluate the VDF ahead of schedule, potentially manipulating the systems that depend on it. The VDF Alliance's strategy of building open-source ASICs aims to establish a public speed baseline, but this remains an ongoing arms race.

Quantum Vulnerability

All widely deployed VDF constructions are vulnerable to quantum computers. A sufficiently powerful quantum computer could factor RSA moduli or compute class group orders, breaking the sequentiality assumption entirely. Recent estimates suggest RSA-2048 factoring may require fewer than one million physical qubits, with hardware roadmaps targeting that scale in the early 2030s. The first plausibly post-quantum VDF construction, Papercraft, was published in 2025 using lattice-based techniques. It can verify approximately six minutes of computation in seven seconds, but remains new and less battle-tested than traditional constructions. Research into quantum-resistant VDFs is an active area of post-quantum cryptography.

Calibration Difficulty

Choosing the time parameter T requires knowledge of the fastest hardware in existence. If T is set too low, the VDF can be computed faster than intended, defeating its purpose. If T is set too high, the system introduces unnecessary latency. There is no way to adjust T dynamically without restarting the VDF evaluation, making parameter selection a challenging engineering problem.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.