An RSA-based Verifiable Delay Function (VDF) is a specific construction of a VDF that relies on the computational hardness of repeated squaring modulo a large composite integer—an RSA modulus. The core operation is computing y = x^(2^T) mod N, where x is an input, T is the prescribed number of sequential steps (the delay), and N is an RSA modulus. This computation is inherently sequential because each squaring depends on the result of the previous one, preventing meaningful speedup through parallelism. The security of this delay relies on the conjecture that there is no shortcut to compute this function faster than performing the T sequential squarings, assuming the factorization of N is unknown.
LABS
Glossary
RSA-based VDF
An RSA-based Verifiable Delay Function (VDF) is a cryptographic primitive that uses the sequential squaring problem in an RSA group to enforce a mandatory, non-parallelizable time delay, producing a unique output that can be verified efficiently.
Chainscore © 2026
definition
VERIFIABLE DELAY FUNCTION
What is an RSA-based VDF?
An RSA-based VDF is a cryptographic primitive that guarantees a computation requires a specific, non-parallelizable amount of elapsed time, with a fast and publicly verifiable proof of correctness.
The verifiability of an RSA-based VDF is achieved through an efficient proof system. After the slow computation produces the output y, a prover can generate a succinct proof, often using Wesolowski's or Pietrzak's interactive protocols made non-interactive via the Fiat-Shamir heuristic. This proof allows any verifier to check, using significantly fewer computational resources than the original evaluation, that y is indeed the correct result of x^(2^T) mod N. This property is crucial for trustless systems where a single party performs the slow work, and others need to instantly confirm its validity without redoing it.
Key parameters and setup are critical for security. The RSA modulus N must be generated in a trusted setup or via a multi-party computation (MPC) ceremony to ensure no single party knows its factorization; if the factors were known, the delay could be broken. The delay parameter T is set according to the desired time window (e.g., 1 minute or 10 minutes). The input x is typically drawn from a verifiable random function (VRF) or a random beacon. This construction is foundational for protocols requiring unbiased, unpredictable randomness in blockchain consensus, such as in Chia's Proof-of-Space-Time or Ethereum's proposed use for random beacon generation.
Compared to other VDF constructions like class group-based VDFs, the RSA-based approach benefits from relying on a long-studied cryptographic assumption (the hardness of factoring). However, its major drawback is the requirement for a trusted setup for the modulus N. If this setup is compromised, the security of the delay guarantee fails completely. In practice, this has led to significant research and execution of complex MPC ceremonies, like the one conducted for the Ethereum ecosystem, to generate a distributed RSA modulus with no single entity possessing the secret factors.
how-it-works
MECHANISM
How an RSA-based VDF Works
An RSA-based Verifiable Delay Function (VDF) is a cryptographic primitive that enforces a predetermined, non-parallelizable computation time, with its output being efficiently verifiable by anyone, using the computational hardness of integer factorization as its security foundation.
An RSA-based VDF leverages the properties of an RSA modulus—a large integer N = p*q which is the product of two secret primes—to create a time-lock puzzle. The core sequential computation is repeated modular squaring: given a starting input x and a time parameter T, the prover must compute the output y = x^(2^T) mod N. This operation is inherently sequential because each squaring depends on the result of the previous one, preventing meaningful speedup through parallel computation. The security relies on the assumption that factoring the large RSA modulus N is computationally infeasible.
The verifiability of the result is achieved through a clever proof mechanism. After computing the slow output y, the prover can generate a short, efficient-to-verify proof. A common method uses a Wesolowski proof, where the verifier sends a random prime l and the prover computes π = x^⌊(2^T)/l⌋ mod N. The verifier then checks that π^l * x^(2^T mod l) ≡ y (mod N). This proof allows anyone to confirm the correctness of y in logarithmic time relative to T, making verification vastly faster than the original computation.
The setup phase is a critical and trusted component. A trusted party must generate the RSA modulus N and subsequently discard its prime factors p and q. If these factors are known, an adversary could compute the output y significantly faster using Euler's theorem and the totient function φ(N), completely breaking the delay property. This requirement for a trusted setup is a notable drawback compared to VDF constructions that do not require one, such as those based on class groups of imaginary quadratic fields.
Practical implementation involves optimizing the sequential squaring loop, often using algorithms like Montgomery reduction for efficient modular arithmetic. The time parameter T is set based on the desired delay length and the speed of the target hardware. RSA-based VDFs were prominently proposed for use in blockchain protocols like Ethereum's consensus mechanism (where the concept was later superseded) and Chia's proof-of-space-and-time, providing a source of unbiased, unpredictable randomness that is resistant to manipulation through last-reveal attacks.
key-features
MECHANICAL PROPERTIES
Key Features of RSA-based VDFs
RSA-based Verifiable Delay Functions (VDFs) are cryptographic primitives that guarantee a minimum, non-parallelizable computation time, enabling trustless generation of randomness and timestamps in decentralized systems.
01
Sequential Computation
The core property of an RSA-based VDF is that it requires a minimum wall-clock time to compute, even with massive parallelism. This is achieved by performing repeated, inherently sequential squarings modulo an RSA modulus (N = p*q). The number of squarings (t) directly determines the delay, making the function uniquely slow to compute but fast to verify.
02
Fast Verification
While computing the output y = x^(2^t) mod N is slow, anyone can verify the result almost instantly using a succinct proof (a Wesolowski or Pietrzak proof). This proof leverages the trapdoor-free nature of the VDF: verifiers do not need the prime factorization of N, ensuring the system remains decentralized and secure.
03
Uniqueness & Soundness
For a given input (x) and time parameter (t), a valid RSA-based VDF produces a unique, deterministic output. The cryptographic soundness guarantees that it is computationally infeasible for an adversary to find a different valid output for the same input, a property critical for preventing manipulation in applications like random beacons and proof-of-replication.
04
Trusted Setup Requirement
A significant drawback is the need for a one-time trusted setup to generate the RSA modulus N = p*q. The primes (p, q) must be securely discarded, as anyone with this factorization can compute the VDF output instantly, breaking the delay guarantee. This introduces a potential centralization point and logistical complexity.
05
Application: Randomness Beacon
RSA-based VDFs are used to construct unbiasable randomness beacons. A source (e.g., a blockchain block hash) is used as the VDF input. The required computation delay ensures the output randomness cannot be predicted or influenced after the input is revealed, enabling applications like lotteries, leader election, and consensus protocols.
06
Alternative: Class Group VDFs
To avoid the trusted setup, class group-based VDFs (e.g., Chia's construction) were developed. They use the arithmetic of imaginary quadratic class groups, which provides a transparent setup—no secrets need to be discarded. While promising, their security is based on less-studied assumptions compared to the well-established RSA problem.
security-assumptions
CRYPTOGRAPHIC PRIMITIVES
Security Assumptions & Foundations
This section details the core cryptographic assumptions and building blocks that underpin blockchain security, focusing on the mathematical problems and protocols that ensure system integrity.
An RSA-based Verifiable Delay Function (VDF) is a cryptographic primitive that guarantees a computation requires a specific, wall-clock time to complete, even with massive parallelism, and produces a unique, publicly verifiable output. Its security is anchored in the sequential squaring assumption within an RSA group, where computing a series of modular squarings cannot be meaningfully sped up by adding more processors. This property makes it ideal for applications requiring unbiased, time-based randomness or proof of elapsed time in decentralized systems, such as leader election in consensus protocols or generating random beacons.
The core operation of an RSA-based VDF involves taking an input x and iteratively squaring it modulo N (the product of two large primes) for a predetermined number of steps T. The prover computes the output y = x^(2^T) mod N and a succinct proof, often using the Wesolowski or Pietrzak protocols, to convince any verifier that the computation was performed correctly without redoing the lengthy work. The security relies on the low-order assumption and the computational hardness of factoring the RSA modulus N, ensuring the delay is enforced and the proof is sound.
In blockchain contexts, RSA-based VDFs address the nothing-at-stake and grinding problems in proof-of-stake consensus. By mandating a real-time delay for generating a valid leader proof, they prevent an adversary from rapidly trying many possibilities to manipulate an outcome. However, their practical adoption faces challenges due to the need for a trusted setup to generate the RSA modulus N and the relatively high computational overhead compared to delay functions based on other algebraic structures, leading to ongoing research into more efficient constructions.
ecosystem-usage
RSA-BASED VDF
Protocols & Ecosystem Usage
RSA-based Verifiable Delay Functions (VDFs) are cryptographic primitives that enforce a minimum, non-parallelizable computation time. They are used in blockchain protocols to create unbiased randomness, secure leader election, and enable proof-of-elapsed-time consensus mechanisms.
01
Core Cryptographic Mechanism
An RSA-based VDF computes a function y = x^(2^T) mod N, where N is a product of two large primes (the RSA modulus) and T is the required number of sequential squarings. The sequentiality is guaranteed by the inherent structure of the RSA group, making it impossible to compute the result faster with parallel hardware. A succinct proof (Wesolowski or Pietrzak) allows anyone to verify the result y in logarithmic time, without re-running the full computation.
02
Random Beacon & Leader Election
VDFs are a key component for generating unpredictable and unbiasable randomness (a random beacon) in consensus protocols. A high-entropy seed is fed into the VDF, and after a fixed delay, the output becomes the verifiable random value. This is critical for:
- Proof-of-Stake leader/committee selection (e.g., Ethereum's RANDAO+VDF design).
- Preventing last-revealer attacks in commit-reveal schemes.
- Ensuring fair ordering in consensus protocols like Chia.
03
Proof-of-Elapsed-Time (PoET) Consensus
In PoET-based blockchains like Chia, an RSA-based VDF serves as the core Proof of Space-Time. Miners first commit disk space (Proof of Space). The winner is determined by who has the fastest VDF evaluation on a challenge derived from their space proof. This creates a fair, energy-efficient consensus where the primary resources are storage and verifiable time, not raw computation (Proof-of-Work).
04
Implementation & Trusted Setup
A critical requirement for RSA-based VDFs is a trusted setup to generate the RSA modulus N. The two prime factors must be securely discarded to ensure no party can compute the VDF faster using a trapdoor. Projects like Chia conducted public, multi-party ceremonies (MPCs) to generate this modulus. The security relies on the sequential squaring assumption within the RSA group and the integer factorization problem.
05
Comparison to Other VDF Constructions
RSA-based VDFs are contrasted with class group-based VDFs (e.g., using imaginary quadratic fields). Key differences:
- RSA VDFs: Require trusted setup but offer very efficient verification and are well-studied.
- Class Group VDFs: Do not require trusted setup (transparent), but verification can be slower. The choice depends on the protocol's trust assumptions and performance requirements for verifiers.
security-considerations
RSA-BASED VDF
Security Considerations & Challenges
RSA-based Verifiable Delay Functions (VDFs) introduce unique security assumptions and attack vectors distinct from their hash-based counterparts, primarily centered on the difficulty of factoring large integers.
02
Quantum Vulnerability
The security of RSA-based VDFs is fundamentally based on the classical hardness of integer factorization. Shor's algorithm, a quantum algorithm, can factor large integers in polynomial time on a sufficiently large quantum computer. This makes RSA-VDFs post-quantum insecure, unlike some hash-based VDFs whose sequentiality relies on inherently quantum-resistant properties.
03
Implementation Side-Channels
The repeated squaring operation (x^(2^T) mod N) must be implemented with constant-time, side-channel resistant algorithms. Vulnerabilities can arise from:
- Timing attacks leaking information about the exponent or modulus.
- Power analysis during modular exponentiation.
- Fault injection to corrupt the computation and produce an invalid proof. These require careful cryptographic engineering at the hardware and software level.
04
Proof Verification Complexity
While computing the VDF is slow, verifying the accompanying proof (e.g., a Wesolowski proof) must be fast. However, the verifier must perform operations modulo the large RSA modulus N. This verification, while efficient, is still significantly more computationally intensive than verifying a hash-based VDF proof, which typically involves just a few hash evaluations. This impacts systems requiring ultra-lightweight clients.
05
Parameter Selection & Group Assumptions
Security depends on correctly generating the RSA group (Z_N^*). This involves:
- Ensuring
pandqare strong primes to resist specialized factoring attacks like Pollard's p-1. - Verifying that the public parameter
g(the base for squaring) generates a sufficiently large subgroup withinZ_N^*. Weak parameter choices can reduce the actual sequential work required below the claimed delay timeT.
06
Parallelism & Hardware Advantages
A core security assumption of any VDF is that the computation cannot be meaningfully parallelized. For RSA-based VDFs, the repeated squaring operation is inherently sequential. However, an adversary with a massive hardware advantage (e.g., a custom ASIC for modular multiplication) could still compute the function faster than the honest party using generic hardware, potentially undermining fairness in applications like leader election or randomness beacons.
ARCHITECTURE
Comparison: RSA-based vs. Other VDF Constructions
A technical comparison of Verifiable Delay Function (VDF) constructions based on their underlying cryptographic assumptions, performance, and practical considerations.
| Feature / Metric | RSA-based (e.g., Wesolowski, Pietrzak) | Class Group-based (e.g., Chia VDF) | Sequential Squaring in Unknown Order Groups | |||
|---|---|---|---|---|---|---|
Cryptographic Assumption | Hardness of integer factorization (RSA) | Hardness of computing class group order | Hardness of group order computation | |||
Proof Size | ~1-2 KB | ~100-200 bytes | ~1-2 KB | |||
Verification Time | < 1 sec | < 10 ms | < 1 sec | |||
Parallelizable Evaluation | ||||||
Post-Quantum Security | ||||||
Hardware Requirements | Standard CPU (large integer arithmetic) | Optimized for GPUs/ASICs | Standard CPU | |||
Trusted Setup Required | RSA group generation | Class group generation | Unknown order group generation | |||
Primary Use Case | Protocols requiring compact proofs (e.g., randomness beacons) | High-throughput, ASIC-friendly chains (e.g., Chia) | Theoretical constructions, less common in practice |
RSA-BASED VERIFIABLE DELAY FUNCTION
Frequently Asked Questions (FAQ)
A Verifiable Delay Function (VDF) is a cryptographic primitive that guarantees a minimum elapsed computation time. RSA-based VDFs, pioneered by Wesolowski and Pietrzak, use the computational hardness of repeated squaring modulo a large RSA integer to create this verifiable delay. This FAQ addresses their core mechanics, applications, and trade-offs.
An RSA-based Verifiable Delay Function (VDF) is a cryptographic construction that enforces a minimum, non-parallelizable computation time, whose output can be verified much faster than it was generated. It works by performing sequential squaring modulo a large RSA integer N = p*q (where p and q are safe primes) for a specified number of steps T. The prover computes y = x^(2^T) mod N from a starting value x. Crucially, the prover can then generate a small, efficient proof (like a Wesolowski proof or Pietrzak proof) that allows any verifier to check the correctness of y in logarithmic time relative to T, without redoing the lengthy computation.
ENQUIRY
Get In Touch
today.
Our experts will offer a free quote and a 30min call to discuss your project.
NDA Protected
Confidentiality24h Response
Time to ValueDirectly to Engineering Team
No Sales Fluff10+
Protocols Shipped
$20M+
TVL Overall