Poster: RANDGENER: Distributed Randomness Beacon from Verifiable Delay Function Arup Mondal Ashoka University Sonipat, Haryana, India arup.mondal phd19@ashoka.edu.in Ruthu Hulikal Rooparaghunath Vrije Universiteit Amsterdam, The Netherlands r.rooparaghunath@student.vu.nl Debayan Gupta Ashoka University Sonipat, Haryana, India debayan.gupta@ashoka.edu.in Abstract—Buoyed by the excitement around secure decen- tralized applications, the last few decades have seen numerous constructions of distributed randomness beacons (DRB) along with use cases; however, a secure DRB (in many variations) remains an open problem. We further note that it is natural to want some kind of reward for participants who spend time and energy evaluating the randomness beacon value – this is already common in distributed protocols. In this work, we present RANDGENER, a novel n-party commit- reveal-recover (or collaborative) DRB protocol with a novel reward and penalty mechanism along with a set of realistic guarantees. We design our protocol using trapdoor watermarkable verifiable delay functions in the RSA group setting (without requiring a trusted dealer or distributed key generation). Index Terms—Randomness Beacon, Verifiable Delay Function. I. INTRODUCTION A randomness beacon [1] is an ideal functionality that continuously publishes independent random values which no party can predict or manipulate; critically, this value must be efficiently verifiable by anyone. A Distributed Randomness Beacon (DRB) protocol allows a set of participants to jointly compute a continuous stream of randomness beacon outputs. A secure DRB protocol should satisfy the following properties, outlined in [2], [3], [4]: (1) Liveness/availability: participants should not be able to prevent the progress of random beacon computation, (2) Guaranteed output delivery: adversaries should not be able to prevent honest participants in the protocol from obtaining a random beacon output, (3) Bias-resistance: no participants should be able to influ- ence future random beacon values to their advantage, (4) Public verifiability: as soon as a random beacon value is generated, it can be verified by anyone independently using only public information, and (5) Unpredictability: participants should not be able to pre- dict the future random beacon values. We introduce two new desirable properties for DRB proto- cols: (6) a reward mechanism, which incentivizes participants who invest time and energy in evaluating the randomness beacon value by rewarding their effort, and (7) a penalty mech- anism, which discourages inadequate participation, incorrect information or cheating by applying penalties for participants who engage in those actions. Our n-party distributed randomness beacon protocol, RANDGENER demonstrates a method of claiming “ownership” of a randomness beacon value evaluation in each round of the protocol’s execution. This is done by attaching a “watermark” of computing participants to the result of the evaluation in or- der to reward corresponding participants for their contribution. Our contributions are summarised as follows: • We extend watermarkable VDF (wVDF) defined in [5] by formally defining a new type called trapdoor wVDF. Furthermore, we demonstrate a construction using Wesolowski [5] and Pietrzak’s [6] scheme. • We construct RANDGENER, an efficient n-party commit- reveal-recover (or collaborative) distributed randomness beacon protocol with a novel reward mechanism and penalty mechanism using a trapdoor wVDF. Our protocol does not require any trusted (or expensive) setup and proves that it provides the desired security properties. Brief Relevant Work: A commit-reveal is a classic approach proposed in [1]. First, all participants publish a commitment yi = Commit(xi) to a random value xi. Next, participants reveal their xi values, resulting in R = Combine(x1, . . . , xn) for some suitable combination function (such as an exclusive- or or a cryptographic hash). However, the output