We consider a public and keyless code (Enc, Dec) which is used to encode a message m and derive a codeword c = Enc(m). The codeword can be adversarially tampered via a function f ∈ F from some "tampering function family" F, resulting in a tampered value c = f (c). We study the different types of security guarantees that can be achieved in this scenario for different families F of tampering attacks.Firstly, we initiate the general study of tamper-detection codes, which must detect that tampering occurred and output Dec(c ) = ⊥. We show that such codes exist for any family of functions F over n bit codewords, as long as |F | < 2 2 n is sufficiently smaller than the set of all possible functions, and the functions f ∈ F are further restricted in two ways: (1) they can only have a few fixed points x such that f (x) = x, (2) they must have high entropy of f (x) over a random x. Such codes can also be made efficient when |F| = 2 poly(n) . For example, F can be the family of all low-degree polynomials excluding constant and identity polynomials. Such tamper-detection codes generalize the algebraic manipulation detection (AMD) codes of Cramer et al. (EUROCRYPT '08).Next, we revisit non-malleable codes, which were introduced by Dziembowski, Pietrzak and Wichs (ICS '10) and require that Dec(c ) either decodes to the original message m, or to some unrelated value (possibly ⊥) that doesn't provide any information about m. We give a modular construction of non-malleable codes by combining tamper-detection codes and leakage-resilient codes. The resulting construction matches that of Faust et al. (EUROCRYPT '14) but has a more modular proof and improved parameters.Finally, we initiate the general study of continuous non-malleable codes, which provide a non-malleability guarantee against an attacker that can tamper a codeword multiple times. We define several variants of the problem depending on: (I) whether tampering is persistent and each successive attack modifies the codeword that has been modified by previous attacks, or whether tampering is non-persistent and is always applied to the original codeword, (II) whether we can "self-destruct" and stop the experiment if a tampered codeword is ever detected to be invalid or whether the attacker can always tamper more. In the case of persistent tampering and self-destruct (weakest case), we get a broad existence results, essentially matching what's known for standard non-malleable codes. In the case of non-persistent tampering and no self-destruct (strongest case), we must further restrict the tampering functions to have few fixed points and high entropy. The two intermediate cases correspond to requiring only one of the above two restrictions.These results have applications in cryptography to related-key attack (RKA) security and to protecting devices against tampering attacks without requiring state or randomness.

No abstract

We study the classical problem of privacy amplification, where two parties Alice and Bob share a weak secret X of min-entropy k, and wish to agree on secret key R of length m over a public communication channel completely controlled by a computationally unbounded attacker Eve.Despite being extensively studied in the literature, the problem of designing "optimal" efficient privacy amplification protocols is still open, because there are several optimization goals. The first of them is (1) minimizing the entropy loss L = k − m (it is known that the optimal value for L = O(λ), where ε = 2 −λ is the desired security of the protocol). Other important considerations include (2) minimizing the number of communication rounds, (3) maintaining security even after the secret key is used (this is called post-application robustness), and (4) ensuring that the protocol P does not leak some "useful information" about the source X (this is called source privacy). Additionally, when dealing with a very long source X, as happens in the so-called Bounded Retrieval Model (BRM), extracting as long a key as possible is no longer the goal. Instead, the goals are (5) to touch as little of X as possible (for efficiency), and (6) to be able to run the protocol many times on the same X, extracting multiple secure keys.Achieving goals (1)-(4) (or (2)-(6) in BRM) simultaneously has remained open, and, indeed, all known protocols fail to achieve at least two of them. In this work we improve upon the current state-of-the-art, by designing a variety of new privacy amplification protocols, in several cases achieving optimal parameters for the first time. Moreover, in most cases we do it by giving relatively general transformations which convert a given protocol P into a "better" protocol P . In particular, as special cases of these transformations (applied to best known prior protocols), we achieve the following privacy amplification protocols for the first time:• 4-round (resp. 2-round) source-private protocol with optimal entropy loss L = O(λ), whenever k = Ω(λ 2 ) (resp. k > n 2 (1 − α) for some universal constant α > 0). Best previous constant round source-private protocols achieved L = Ω(λ 2 ).• 3-round post-application-robust protocols with optimal entropy loss L = O(λ), whenever k = Ω(λ 2 ) or k > n 2 (1−α) (the latter is also source-private). Best previous post-application robust protocols achieved L = Ω(λ 2 ).• The first BRM protocol capable of extracting the optimal number Θ(k/λ) of session keys, improving upon the previously best bound Θ(k/λ 2 ). (Additionally, our BRM protocol is post-application-robust, takes 2 rounds, and can be made source-private by increasing the number of rounds to 4.) *

No abstract