Worst-Case Analysis of the Soundness of Efficient Verifiable Delay Function

A Verifiable Delay Function (VDF) is a function that takes a specified sequential time
$T$
to be evaluated, but can be verified in
$\mathcal{O} (\log T)$
-time. VDFs have several applications, like blockchains in crypto-currencies. that demand public verifiability of proofs. The efficient verifiable delay function (Wesolowski, EUROCRYPT 2019) is considered to be one of the finest constructions in this domain of research. In order to achieve computational soundness with respect to the security parameter λ, the verifier in Wesolowski's VDF challenges the prover with a prime
$\ell$
sampled from the set of first
$2^{2\lambda}$
primes, uniformly at random. So, on average, it samples
$\Omega(\lambda \log \lambda)$
-bit primes, but in the worst-case the sampled primes may be smaller than
$2^{\lambda}$
. In this work, we show that this VDF has a vulnerability in the worst-case sampling of primes, so it is necessary to avoid the primes smaller than
$2^{\lambda}$
. Otherwise, we construct an efficient adversary that breaks the computational soundness of this VDF with probability
$1/\ell$
.