---
res:
  bibo_abstract:
  - "A verifiable delay function VDF(x, T)->(y, π) maps an input x and time parameter
    T to an output y together with an efficiently verifiable proof π certifying that
    y was correctly computed. The function runs in T sequential steps, and it should
    not be possible to compute y much faster than that. The only known practical VDFs
    use sequential squaring in groups of unknown order as the sequential function,
    i.e., y = x^2^T. There are two constructions for the proof of exponentiation (PoE)
    certifying that y = x^2^T, with Wesolowski (Eurocrypt’19) having very short proofs,
    but they are more expensive to compute and the soundness relies on stronger assumptions
    than the PoE proposed by Pietrzak (ITCS’19).\r\nA recent application of VDFs by
    Arun, Bonneau and Clark (Asiacrypt’22) are short-lived proofs and signatures,
    which are proofs and signatures that are only sound for some time t, but after
    that can be forged by anyone. For this they rely on “watermarkable VDFs”, where
    the proof embeds a prover chosen watermark. To achieve stronger notions of proofs/signatures
    with reusable forgeability, they rely on “zero-knowledge VDFs”, where instead
    of the output y, one just proves knowledge of this output. The existing proposals
    for watermarkable and zero-knowledge VDFs all build on Wesolowski’s PoE, for the
    watermarkable VDFs there’s currently no security proof.\r\n\r\nIn this work we
    give the first constructions that transform any PoEs in hidden order groups into
    watermarkable VDFs and into zkVDFs, solving an open question by Arun et al. Unlike
    our watermarkable VDF, the zkVDF (required for reusable forgeability) is not very
    practical as the number of group elements in the proof is a security parameter.
    To address this, we introduce the notion of zero-knowledge proofs of sequential
    work (zkPoSW), a notion that relaxes zkVDFs by not requiring that the output is
    unique. We show that zkPoSW are sufficient to construct proofs or signatures with
    reusable forgeability, and construct efficient zkPoSW from any PoE, ultimately
    achieving short lived proofs and signatures that improve upon Arun et al.’s construction
    in several dimensions (faster forging times, arguably weaker assumptions).\r\nA
    key idea underlying our constructions is to not directly construct a (watermarked
    or zk) proof for y = x^2^T, but instead give a (watermarked or zk) proof for the
    more basic statement that \r\nx^l, y^l satisfy x^l = x ^r, y^l = y^r for some
    r, together with a normal PoE for y^l = (x^l)^2^T.@eng"
  bibo_authorlist:
  - foaf_Person:
      foaf_givenName: Charlotte
      foaf_name: Hoffmann, Charlotte
      foaf_surname: Hoffmann
      foaf_workInfoHomepage: http://www.librecat.org/personId=0f78d746-dc7d-11ea-9b2f-83f92091afe7
    orcid: 0000-0003-2027-5549
  - foaf_Person:
      foaf_givenName: Krzysztof Z
      foaf_name: Pietrzak, Krzysztof Z
      foaf_surname: Pietrzak
      foaf_workInfoHomepage: http://www.librecat.org/personId=3E04A7AA-F248-11E8-B48F-1D18A9856A87
    orcid: 0000-0002-9139-1654
  bibo_doi: 10.1007/978-3-031-91820-9_2
  bibo_volume: 15674
  dct_date: 2025^xs_gYear
  dct_isPartOf:
  - http://id.crossref.org/issn/0302-9743
  - http://id.crossref.org/issn/1611-3349
  - http://id.crossref.org/issn/9783031918193
  dct_language: eng
  dct_publisher: Springer Nature@
  dct_title: Watermarkable and zero-knowledge Verifiable Delay Functions from any
    proof of exponentiation@
...