# Legendre PRF bounties for concrete instances

In addition to the algorithmic bounties announced at CRYPTO’19 in order to improve the state of cryptanalysis of the Legendre PRF, the Ethereum Foundation also wants to encourage concrete algorithmic development. In total, there are five key recovery challenges for the Legendre PRF – if you can find the key belonging to the output bits below, you will be rewarded the bounties.

## Redeeming the bounties

The smart contract for redeeming the bounties is now live at 0x64af032181669383a370aE6e4b438ee26bB559b7. You can find instructions on claiming the bounties using the smart contract here

These bounties are open until December 31, 2020.

## Test challenge

Prime:  0x000000000000000000000000000000000000000000000000000000ffffffffa9
Challenge value (First 256 bytes):  782408b40187dec329043bcf60b4d9769c1a567bac18bf18aab7bd7bb484b16
e674842ce9f8d1788fe213a7d89f5677ac056c364a18d13cc726c898a39e4574204759df225b755faf4c23f797cd78495b2
fab46d396a0fc9c290f4fc863e856cb9fd6c8935aa34c0c19fca115e1f803d5e2cd9c0d9dcace708c1d9d956f4ce780b67b
94470ab7912775a67dfc3cea477a00ca4d37d49612315bccc5ef3


Full challenge bits: test.bin

There is no bounty on this challenge. Use this to test your algorithm. You should find the key:

Key:  0x0000000000000000000000000000000000000000000000000000004e2dea1f3c


## Challenge 0 – CLAIMED

This challenge has been claimed! Congratulations to Ward Beullens and Tim Beyne.

Unfortunately, this means you cannot win 1 ETH anymore, but you can still use this challenge to test your algorithm.

Prime:  0x000000000000000000000000000000000000000000000000ffffffffffffffc5
Bounty:  1 ETH
Challenge value (First 256 bytes):  574fb3b032a69799873a3335cf928752b630e7785d76276845ed02e3fd290b0
a118c35585f940cf1bf4183bf377301a2b9dba8f9acd3d937026cdc0097994c59feca7e0926f91a0eb64c29391b5a7e1cfd
f30d7346e0da11214f5e280f29644fd09092ab9ecb761fe23f4c4b71fe4cf8e4964577ed41a2a71edb3229d196ce7bafc81
83d739211f988610cdc8a31a13f25927d6cd7c86774d7eb56c6d08d0c13bf81137426a20ca6dd4e2a4de3340c476c537b17
2989ac5e7bc6966cfcea47bddceec01b36c49c5a7fbdeae9479f9


Full challenge bits: 0.bin

The correct key for this challenge is:

Key: 0x000000000000000000000000000000000000000000000000090644c931a3fba5


## Challenge 1 – CLAIMED

This challenge has been claimed, see transaction on etherscan.

Unfortunately, this means you cannot win 2 ETH anymore, but you can still use this challenge to test your algorithm.

Prime:  0x0000000000000000000000000000000000000000000003ffffffffffffffffdd
Bounty:  2 ETH
Challenge value (First 256 bytes):  5bfc5abb616dcb96eb812884d9be93ef9f42ed96079ab60230a3f874b15a965
36e85568932a1d06d120da7eae0aabf2aa23915be33f4c2613ce858d72c830fb511eef1dd6d08dc1323d96d9a6e938bc870
28d98773a157442087b5970473965b5d0bb33cd6340b15da4c9019eef98a1e009d0c4a0924013e33b648edacc4d3cd0077d
335773913d7ea7de8302a3d8de66f44e54ce7ca834971f895d748a9558765ba3f1530c3f47af8979a5d33f61ff8289ea3bc
86bff8849a59d5302e1bbea33048b71d5e9ef93cd5d98716d8c35


Full challenge bits: 1.bin

The correct key for this challenge is

Key: 0x000000000000000000000000000000000000000000000384f17db02976dcf63d


## Challenge 2 – CLAIMED

This challenge has been claimed.

Unfortunately, this means you cannot win 4 ETH anymore, but you can still use this challenge to test your algorithm.

Prime:  0x0000000000000000000000000000000000000000000fffffffffffffffffffdd
Bounty:  4 ETH
Challenge value (First 256 bytes):  bafca94ade9b5201633be31512efcaec7cbe64cbfd2806e83ca398ee34209e0
1a14bc727418baa31692ebc91681018527738fea54c9f1d45233fff8de5cce971b2111e012374f10ee3fbca4e276313ba8f
82b07e63980bbdd754ce80b39090ba04c52e4e186f42f75e7f9bd097fdf23105f123a7b95101dd053e66d84a2ddbc939815
986ca510e29f2864df6a513f143800f79cc62bfed7d4b2ba0a128090ac2e7a2b4857bb703cd425f941d8e47c80ef243a770
5f05beef1c4a0d2dabb1cbc22bca06bd935ca25a7237ffee5bfcc


Full challenge bits: 2.bin

The correct key for this challenge is

Key: 0x0000000000000000000000000000000000000000000027aaa97c746c22e12d04


## Challenge 3

Prime:  0x000000000000000000000000000000000000000ffffffffffffffffffffffff1
Bounty:  8 ETH
Challenge value (First 256 bytes):  8544ea9871766a120112b6106bb0a2e6e34c5f0951dfb43a59932f879c3e0d9
1a00065b4dbd7d16edbef103f180f8ee75e2950c7073911b4e51bb8ce4caf97b7f66b81d816c08b71a34015a097a5933ec7
dbca5a3d838c243a5168fb5a67cfb66c1bc7144ab026312cae2507cabf2f5a515b29bace620e38586de37e1985cabe8edff
08c4c3b0d7fa5dc6a34e8fa3bd427498c5a37a2bf464c2cacba72


Full challenge bits: 3.bin

These values will be used by the bounty smart contract to check the correctness of the solution:

Check value:  0x0000000000000000000000000008544ea9871766a120112b6106bb0a2e6e34c5
Check length:  148


## Challenge 4

Prime:  0x000000000000000000000000000fffffffffffffffffffffffffffffffffff59
Bounty:  16 ETH
Challenge value (First 256 bytes):  aaf064eee3a15f46755777368a8abc00f274ea7a4ed4790e598067b2e671de7
686d281f889b28490de26b223cb0bbfb12ae6d9fee7aa0cf0d7f539a8f27eb2a71b991621f351f02ba0815e11e915655e4f
348bb574fc0a856cb104f8e8df38a2330b4713ec6bc23781a4a5b1c1e906689bff0d78068b5250208cdf76b589c03a0d557

Check value:  0x000000000000000000000000000aaf064eee3a15f46755777368a8abc00f274e