Continuously Non-malleable Codes with Split-State Refresh

Abstract

Non-malleable codes for the split-state model allow to encode a message into two parts, such that arbitrary independent tampering on each part, and subsequent decoding of the corresponding modified codeword, yields either the same as the original message, or a completely unrelated value. Continuously non-malleable codes further allow to tolerate an unbounded (polynomial) number of tampering attempts, until a decoding error happens. The drawback is that, after an error happens, the system must self-destruct and stop working, otherwise generic attacks become possible.In this paper we propose a solution to this limitation, by leveraging a split-state refreshing procedure. Namely, whenever a decoding error happens, the two parts of an encoding can be locally refreshed (i.e., without any interaction), which allows to avoid the self-destruct mechanism in some applications. Additionally, the refreshing procedure can be exploited in order to obtain security against continual leakage attacks. We give an abstract framework for building refreshable continuously non-malleable codes in the common reference string model, and provide a concrete instantiation based on the external Diffie-Hellman assumption.Finally, we explore applications in which our notion turns out to be essential. The first application is a signature scheme tolerating an arbitrary polynomial number of split-state tampering attempts, without requiring a self-destruct capability, and in a model where refreshing of the memory happens only after an invalid output is produced. This circumvents an impossibility result from a recent work by Fuijisaki and Xagawa (Asiacrypt 2016). The second application is a compiler for tamper-resilient read-only RAM programs. In comparison to other tamper-resilient RAM compilers, ours has several advantages, among which the fact that, in some cases, it does not rely on the self-destruct feature.

Continuously Non-Malleable Codes in the Split-State Model from Minimal Assumptions

“…In this paper, we focus only on the "default flavor" of continuous non-malleability. This in contrast to previous work on continuously nonmalleable codes (except [20,19,28]), which instead by default considered continuous super non-malleability. While the notion we consider is strictly weaker than continuous strong or super non-malleability, to the best of our knowledge, it is sufficient for all known applications of continuously non-malleable codes, in particular [30,31,20,19,28].…”

“…The only known constructions of a CNMC in the split-state model (therefore also achieving message uniqueness) are the codes of [30,28], but unfortunately these constructions rely on both trusted setup and strong computational assumptions. Indeed such codes require: (i) a "common reference string", i.e., the existence of a honestly generated string (with some given distribution) that is assumed to be untamperable, and that is available to the encoding and decoding functions, and to the adversary; (ii) the existence of non-interactive zeroknowledge proofs and either collision-resistant hash functions [30] or public-key encryption resilient to continual leakage [24,28] (which we only know how to obtain under concrete number-theoretic assumptions over bi-linear groups). 8 Since [30] by default considered continuous super non-malleability, they require an even stronger form of uniqueness called codeword uniqueness, which intuitively says that it should be hard to find (c0, c1,c1) such that both (c0, c1) and (c0,c1) are valid, and c1 =c1, even if the two codewords encode the same message.…”

“…Non-malleable codes. Only a few constructions of continuously non-malleable codes are known (besides the already mentioned constructions of [30,28]). In particular, continuous non-malleability is known to be achievable in the informationtheoretic setting, for the simpler cases of bit-wise independent tampering [20,19] (where each bit of the codeword is tampered independently), and constant-state tampering [5].…”

Security of Hedged Fiat–Shamir Signatures Under Fault Attacks

“…Similar limitations have been considered before in the literature to circumvent impossibility results, in particular in the so called split-state model [DPW18]. Several constructions have been proposed in this model including: non-malleable codes (Dziembowski, Pietrzak and Wichs [DPW18]), signature schemes (Faonio et al [FNSV18]), and more (Liu and Lysyanskaya [LL12]).…”

Practical Continuously Non-malleable Randomness Encoders in the Random Oracle Model

“…The compiler from LRREs to CNMREs is very similar to the original construction of CNMC of [33], and its proof of security follows a proof technique similar to [14,29,32]. Our LRREs are inspired by the leakage-resilient storage of Davi, Dziembowski and Venturi [18] based on the inner-product extractor (see also Dziembowski and Faust [21]).…”