Bitcoin Beacon

We examine a protocol π_beacon that outputs unpredictable and publicly verifiable randomness, meaning that the output is unknown at the time that π_beacon starts, yet everyone can verify that the output is close to uniform after π_beacon terminates. We show that π_beacon can be instantiated via Bitcoin under sensible assumptions; in particular we consider an adversary with an arbitrarily large initial budget who may not operate at a loss indefinitely. In case the adversary has an infinite budget, we provide an impossibility result that stems from the similarity between the Bitcoin model and Santha-Vazirani sources. We also give a hybrid protocol that combines trusted parties and a Bitcoin-based beacon.