A time-lock puzzle is a cryptographic construct that requires a minimum, predetermined amount of sequential computational work to solve, effectively creating a digital "time capsule." The puzzle's solution is a secret, such as a decryption key, that remains inaccessible until the specified time has passed. This is achieved by designing a computation that cannot be parallelized, meaning throwing more processors at the problem does not significantly speed it up. The canonical example uses repeated squaring modulo a large composite number, a process that must be performed step-by-step.
LABS
Glossary
Time-lock Puzzle
A cryptographic mechanism that enforces a mandatory, sequential computation time to unlock data or prove work, forming the basis for Verifiable Delay Functions (VDFs).
Chainscore © 2026
definition
CRYPTOGRAPHIC PRIMITIVE
What is a Time-lock Puzzle?
A cryptographic mechanism that enforces a mandatory, verifiable delay before a secret can be accessed or a computation can be completed, without relying on trusted third parties.
The primary innovation of time-lock puzzles is trust minimization. Unlike simply encrypting data with a key to be released later (which requires trusting the key holder), a time-lock's delay is cryptographically guaranteed and publicly verifiable. Anyone can create a puzzle that will take, for example, exactly one year of continuous computation to unlock, and any solver can prove they have done the work. This makes them crucial for applications like sealed-bid auctions, where bids must be revealed simultaneously after a deadline, or delayed key disclosure for wills or contingency plans.
In blockchain contexts, time-lock puzzles interact with core protocols like Bitcoin Script through OP_CHECKLOCKTIMEVERIFY (CLTV) and OP_CHECKSEQUENCEVERIFY (CSV), which enforce spending delays but are not computational puzzles themselves. True time-lock puzzles are an active area of research for proof-of-sequential-work and securing blockchain light clients. A significant challenge is accurately estimating the "wall-clock" time the puzzle will take, as computational hardware advances. Modern proposals often use verifiable delay functions (VDFs), which are a more efficient and verifiable class of time-lock puzzles, to anchor events in decentralized systems.
how-it-works
CRYPTOGRAPHIC PRIMITIVE
How a Time-lock Puzzle Works
A time-lock puzzle is a cryptographic protocol that encrypts a message so that it can only be decrypted after a specific, predetermined amount of sequential computational work has been performed, effectively creating a 'timed' secret.
A time-lock puzzle is a cryptographic construction designed to hide information for a predetermined period of time. It is based on the principle that certain computations cannot be parallelized and must be performed sequentially. The canonical method, proposed by Rivest, Shamir, and Wagner, uses repeated squaring modulo a large composite number. The puzzle creator, knowing the prime factorization, can generate the solution instantly, while any solver must perform the squaring steps one after another, with no computational shortcut. This creates a verifiable delay, where the time to unlock is a function of the number of sequential operations, not raw processing power.
The core mechanism relies on the computational asymmetry between setting and solving the puzzle. To create a puzzle that takes roughly T seconds to solve, the creator selects a modulus n = p*q (the product of two large primes) and computes the value 2^(2^t) mod n by leveraging Euler's theorem and the knowledge of φ(n). They then encrypt the secret message with this result as a key. The solver, lacking the factorization, has no choice but to perform the 2^t sequential squarings modulo n to derive the same key and decrypt the message. The security rests on the difficulty of factoring n and the inherent sequential nature of the computation.
In blockchain systems, time-lock puzzles enable timed commitments and fair exchange protocols. A prominent application is in verifiable delay functions (VDFs), which are a more formal and secure evolution of the concept. VDFs use time-lock puzzles to generate unbiased, unpredictable randomness for consensus mechanisms (like in Ethereum's RANDAO/VDF) or to prove the passage of time in proof-of-stake protocols. They ensure that a leader in a consensus round was selected after a specific delay, preventing last-reveal attacks and creating a reliable source of public randomness that is resistant to manipulation.
key-features
MECHANICAL PROPERTIES
Key Features of Time-lock Puzzles
Time-lock puzzles are cryptographic primitives that enforce a mandatory, sequential computational delay before a secret can be revealed, independent of parallel processing power.
01
Sequential Work Function
The core mechanism that prevents parallelization. A time-lock puzzle requires the solver to perform a predetermined number of sequential computational steps, such as repeated modular squaring. This ensures the solving time is a function of real-world clock time, not just raw processing power.
02
Verifiable Solution
Once the time-lock period has passed and the solution is found, anyone can instantly verify its correctness with minimal computation. This property, enabled by a trapdoor or public parameters set during puzzle creation, is crucial for trustless applications where the result must be publicly auditable.
03
Deterministic Delay
The creator of the puzzle can precisely parameterize the required solving time (e.g., 1 year) by setting the number of sequential operations. This creates a predictable, cryptographically-enforced waiting period that is reliably the same for any solver, regardless of their hardware advancements after the puzzle is created.
04
Example: Rivest, Shamir, and Wagner (RSW)
The canonical construction involves computing v = (2^(2^t)) mod n, where t is the time parameter. Creating the puzzle uses a trapdoor (the factorization of n) for speed. Solving it requires performing t sequential squarings without the trapdoor, making it the definitive practical example of a verifiable delay function (VDF) built from a time-lock puzzle.
05
Application: Timed Commitments
Used in scenarios where a secret must be revealed after a specific time. Examples include:
- Sealed-bid auctions: Revealing bids only after the bidding period closes.
- Blockchain consensus: As in Chia's Proof-of-Space-and-Time, where a VDF (an advanced time-lock puzzle) creates deterministic delays between blocks.
- Key escrow: Releasing a decryption key after a legal hold period.
06
Relation to Verifiable Delay Functions (VDFs)
A Verifiable Delay Function (VDF) is a modern, more formalized evolution of the time-lock puzzle concept. All VDFs are time-lock puzzles, but not all time-lock puzzles are VDFs. VDFs impose stricter requirements, including uniqueness (only one valid output) and sequentiality being inherent to the function itself, making them more suitable for decentralized systems like blockchain protocols.
vdf-relationship
CRYPTOGRAPHIC PRIMITIVES
Relationship to Verifiable Delay Functions (VDFs)
A time-lock puzzle is a cryptographic primitive that enforces a mandatory, non-parallelizable computation delay, a concept formalized and made verifiable by Verifiable Delay Functions (VDFs).
A time-lock puzzle is a cryptographic construct that requires a minimum amount of sequential computation to solve, creating a forced time delay. A Verifiable Delay Function (VDF) is the formalization of this concept, providing a way to prove that a specific, non-parallelizable delay has elapsed, without requiring the verifier to redo the work. While all VDFs implement a time-lock, not all time-lock puzzles are VDFs; the critical distinction is verifiability. Early puzzles, like Rivest's time-lock crypto, lacked an efficient verification mechanism, whereas a VDF produces a succinct proof that anyone can verify almost instantly.
The core mechanism linking them is the requirement for sequential computation. Both are built on inherently sequential mathematical functions, such as repeated squaring in a group of unknown order (e.g., an RSA group or a class group). This sequentiality ensures that even with massive parallelism, the solution cannot be found faster than the prescribed number of steps. The VDF enhances the basic puzzle by appending an efficient proof generation phase after the delay, which cryptographically commits to the output and the fact that the correct number of steps were performed.
In blockchain contexts, this relationship is fundamental for creating trustless timing. VDFs provide the "clock" for protocols, enabling applications like random beacon generation (e.g., Ethereum's RANDAO+VDF), proof-of-space-time, and securing consensus against grinding attacks. Here, the time-lock property ensures leader election or randomness cannot be manipulated at the last minute, as the VDF output is only available after a predictable delay. This decouples system progress from physical time measurements, which are unreliable in decentralized networks.
The security assumptions differ slightly: a classic time-lock puzzle often relies on the computational hardness of factoring (RSA assumption), while modern VDF designs may also rely on the hardness of problems in class groups or other algebraic structures. Furthermore, VDFs introduce additional considerations like proof soundness and the threat of precomputation attacks, where an adversary with prior knowledge could compute the output in advance, undermining the delay's purpose in certain applications.
examples
TIME-LOCK PUZZLE
Examples & Use Cases
Time-lock puzzles are cryptographic mechanisms that enforce a mandatory, verifiable waiting period before a secret can be accessed. Here are key applications where this property is essential.
ecosystem-usage
TIME-LOCK PUZZLE
Ecosystem Usage
A time-lock puzzle is a cryptographic primitive that encrypts a message so it can only be decrypted after a specific, predetermined amount of computational work has been performed, effectively creating a forced time delay. This section details its core applications across blockchain and cryptography.
02
Timelock Encryption & Sealed-Bid Auctions
Time-lock puzzles enable messages to be encrypted for the future. A sender can encrypt data so that the recipient, even with significant parallel computing power, cannot decrypt it until a certain time has passed. This is used for:
- Sealed-Bid Auctions: Bids are encrypted with a time-lock. After the bidding period, the decryption key is published, revealing all bids simultaneously and fairly.
- Digital Time Capsules: Encrypting information meant to be accessed only at a future date.
03
Layer 2 Withdrawal Delays & Security
In blockchain scaling solutions, time-lock puzzles enforce critical security delays. A common implementation is the challenge period in optimistic rollups.
- When a user initiates a withdrawal, funds are locked for a set period (e.g., 7 days).
- This delay allows any verifier to submit a fraud proof if the withdrawal is invalid.
- The forced waiting period acts as a cryptographic time-lock, ensuring the system's security without requiring immediate computation.
05
Proof-of-Work vs. Time-Lock
While both require computational work, they serve different purposes:
- Proof-of-Work (PoW): Designed to be parallelizable and probabilistic. Miners race to find a hash below a target. The goal is decentralized consensus and security through economic cost.
- Time-Lock Puzzle / VDF: Designed to be inherently sequential and deterministic. The goal is to guarantee a minimum elapsed time, regardless of parallel computing power. It creates a reliable delay, not a consensus mechanism.
06
Limitations and Practical Considerations
Implementing time-lock puzzles requires careful parameter selection and hardware assumptions.
- Hardware Advances: The security of the time delay depends on the assumption that no radical speedup in sequential computation is possible (e.g., via ASICs for the specific VDF).
- Parameter Setting: Choosing the delay parameter
Trequires estimating future hardware speeds to ensure the delay remains meaningful. - Verification Cost: While verification must be fast, some constructions (unlike VDFs) may have verification costs that grow with
T.
security-considerations
TIME-LOCK PUZZLE
Security Considerations
Time-lock puzzles are cryptographic primitives that enforce a mandatory, non-parallelizable delay before a secret can be revealed, creating a fundamental security trade-off between guaranteed wait time and computational cost.
01
The Verifiable Delay Function (VDF) Core
Modern time-lock puzzles are built on Verifiable Delay Functions (VDFs), which guarantee a sequential computation time that cannot be sped up by parallel processing. This is the security foundation, ensuring the enforced delay is wall-clock time, not just computational work. The VDF's output must be efficiently verifiable by anyone, preventing malicious actors from faking a solution.
- Key Property: Inherently sequential computation.
- Example: Sloth (square root in a finite field) or Wesolowski's and Pietrzak's VDFs based on repeated squaring in a group of unknown order.
02
Trusted Setup & Parameter Selection
The security of many VDF constructions depends critically on a trusted setup to generate a public parameter, often a group of unknown order (like an RSA modulus). If this setup is compromised, an attacker could solve the puzzle instantly. Furthermore, selecting the delay parameter T is crucial:
- Underestimation: If
Tis too low, the puzzle is trivially solvable, breaking the security assumption. - Overestimation: If
Tis too high, it can render the underlying application (e.g., a sealed-bid auction) unusable.Tmust be calibrated for the expected hardware speed over the puzzle's lifetime.
03
Precomputation & Caching Attacks
A significant threat is precomputation. If the puzzle input (the statement to be time-locked) is known far in advance, an attacker can start computing the VDF solution early, negating the delay when the puzzle is officially "started." Mitigations include:
- Commit-Reveal Schemes: The puzzle is set on a commitment (hash) of the secret, which is only revealed to start the timer.
- Randomness Injection: Incorporating a recent, unpredictable value (e.g., a block hash) into the puzzle input to force computation to start at a specific time.
04
Parallelism & Hardware Advancements
While VDFs are designed to be sequential, real-world security must account for hardware advancements. An attacker with a faster, specialized ASIC for the specific VDF algorithm could solve the puzzle sooner than the anticipated delay for generic hardware. This requires a conservative safety margin in the T parameter. The security model assumes no algorithmic shortcut exists; the discovery of such a shortcut would break all puzzles using that VDF.
05
Application-Specific Risks
The security of the time-lock puzzle is only as strong as its integration. Key risks include:
- Reveal Phase Vulnerabilities: The mechanism for submitting and verifying the solution must be secure and reliable. A faulty smart contract could allow a correct solution to be rejected or a false one accepted.
- Liveness Assumptions: Applications like delayed key revelation for custody solutions depend on the solver being live to provide the answer after the delay. If they fail, the locked asset may become permanently inaccessible.
- Front-Running: In blockchain contexts, a solved puzzle answer in the mempool can be observed and front-run by other users.
06
Economic & Game-Theoretic Incentives
Security often depends on correctly aligning incentives. The cost of computation (electricity, hardware) to solve the puzzle must be significantly less than the value of the locked secret, or no one will solve it. Conversely, if the reward for solving is too high, it could incentivize the development of breaking techniques. The system must ensure the solver is properly compensated and that there is a disincentive for the party who created the puzzle to also be the solver (which could enable precomputation attacks).
COMPUTATIONAL PUZZLES
Comparison: Time-lock Puzzle vs. Proof-of-Work
A technical comparison of two cryptographic puzzles designed to enforce a time delay versus one designed to secure a blockchain.
| Feature | Time-lock Puzzle | Proof-of-Work |
|---|---|---|
Primary Purpose | Enforce a mandatory time delay for decryption or access | Secure a decentralized ledger via competitive consensus |
Computational Nature | Inherently sequential; cannot be parallelized | Embarrassingly parallel; can be scaled with more hardware |
Verification Speed | Fast and deterministic (milliseconds) | Fast and deterministic (milliseconds) |
Solution Time Control | Tunable via difficulty parameter (e.g., RSA modulus size) | Probabilistic; adjusted via network difficulty |
Energy Consumption | Low (single computation path) | Extremely High (massive parallel hashing) |
Resource Requirement | Computational steps (CPU cycles) | Hashing power (ASIC/GPU farms) |
Key Cryptographic Primitive | Repeated squaring modulo N | Cryptographic hash function (e.g., SHA-256) |
Use Case Example | Timed-release cryptography, sealed-bid auctions | Bitcoin, Ethereum 1.0 blockchain security |
TIME-LOCK PUZZLES
Frequently Asked Questions
A time-lock puzzle is a cryptographic primitive that encrypts data so it can only be decrypted after a specific amount of time has passed, enforced by computational work rather than a calendar date.
A time-lock puzzle is a cryptographic mechanism that encrypts information so it can only be decrypted after a predetermined amount of sequential computational work has been performed. It works by creating a problem that is inherently serial, meaning it cannot be solved significantly faster by adding more parallel processors. The most common construction uses repeated squaring modulo a large composite number. The puzzle creator performs a set number of squaring operations to encrypt the secret, and the solver must perform the same lengthy, non-parallelizable computation to decrypt it, effectively enforcing a time delay. This creates a computational time capsule.
ENQUIRY
Get In Touch
today.
Our experts will offer a free quote and a 30min call to discuss your project.
NDA Protected
Confidentiality24h Response
Time to ValueDirectly to Engineering Team
No Sales Fluff10+
Protocols Shipped
$20M+
TVL Overall