Bandersnatch VRF Specification
August 21, 2026 ยท View on GitHub
This specification defines three Verifiable Random Function with Additional Data (VRF-AD) schemes -- Tiny VRF, Thin VRF, and Pedersen VRF -- built on a transcript-based Fiat-Shamir transform with support for multiple input/output pairs via delinearization. Tiny VRF and Thin VRF are loosely inspired by IETF ECVRF [RFC-9381]. Pedersen VRF follows the construction introduced by [BCHSV23] and serves as a building block for anonymized ring signatures based on the ring proof scheme derived from [CSSV22].
All schemes are instantiated over the Bandersnatch elliptic curve, constructed over the BLS12-381 scalar field as specified in [MSZ21].
Test Vectors
The assets folder describes these files, the KZG reference strings and the example program. The ring vectors are deterministic, because the prover runs with no column blinding, and such a proof is not zero-knowledge.