Information-Theoretic Local Non-malleable Codes and Their Applications

Abstract

Error correcting codes, though powerful, are only applicable in scenarios where the adversarial channel does not introduce "too many" errors into the codewords. Yet, the question of having guarantees even in the face of many errors is well-motivated. Non-malleable codes, introduced by Dziembowski, Pietrzak and Wichs (ICS 2010), address precisely this question. Such codes guarantee that even if an adversary completely over-writes the codeword, he cannot transform it into a codeword for a related message. Not only is this a creative solution to the problem mentioned above, it is also a very meaningful one. Indeed, nonmalleable codes have inspired a rich body of theoretical constructions as well as applications to tamper-resilient cryptography, CCA2 encryption schemes and so on. Another remarkable variant of error correcting codes were introduced by Katz and Trevisan (STOC 2000) when they explored the question of decoding "locally". Locally decodable codes are coding schemes which have an additional "local decode" procedure: in order to decode a bit of the message, this procedure accesses only a few bits of the codeword. These codes too have received tremendous attention from researchers and have applications to various primitives in cryptography such as private information retrieval. More recently, Chandran, Kanukurthi and Ostrovsky (TCC 2014) explored the converse problem of making the "re-encoding" process local. Locally updatable codes have an additional "local update" procedure: in order to update a bit of the message, this procedure accesses/rewrites only a few bits of the codeword. At TCC 2015, Dachman-Soled, Liu, Shi and Zhou initiated the study of locally decodable and updatable non-malleable codes, thereby combining all the important properties mentioned above into one tool. Achieving locality and non-malleability is non-trivial. Yet, Dachman-Soled et al. provide a meaningful definition of local non-malleability and provide a construction that satisfies it. Unfortunately, their construction is secure only in the computational setting.

Continuously Non-Malleable Codes in the Split-State Model from Minimal Assumptions

“…In fact, the commitments produced by the tampering functions could play an important role for the success of the adversary! This issue will be resolved by additionally assuming that the inner NMC be a leakage-resilient NMC, 13 which allows us to obtain (via a leakage query) the modified commitment as generated by the tampering functions (φ 0 , φ 1 ) chosen by the adversary. As we show, this leakage can be used by the distinguisher of the inner auxiliary NMC to simulate consistently the view of the distinguisher attacking the full code, thus reaching a contradiction.…”

“…The typical application of non-malleable codes is the protection of cryptographic algorithms from tampering attacks against the memory [27,38,30]. Non-malleable codes were also used to protect arbitrary computations (and not only storage) against tampering [22,31,13].…”

“…We refer the reader to §1.5 for an overview of known constructions of non-malleable codes for different classes Φ. Previous work showed how to construct split-state non-malleable codes, both for the information-theoretic setting [27,25,4,18,6,3,13,7,37] and the computational setting [38,30,22,2].…”

Continuously non-malleable codes with split-state refresh

“…Several constructions of non-malleable codes in the split-state model appeared in the literature, both for the information-theoretic [32,31,3,20,4,2,14,5,48,49,17] and computational setting [50,36,24,1,46,52,23]. Non-malleable codes exist also for several other models besides split-state tampering, including bit-wise independent tampering and permutations [20,6,7,22,21], circuits of polynomial size [32,19,38,39], constant-state tampering [18], block-wise tampering [13], space-bounded algorithms [35,9], bounded-depth circuits [8,16], and partial functions [47].…”

“…Lemma 16. For all PPT adversaries A there exists a negligible function ν 13,14 : N → [0, 1] such that P G 13 A (κ) = 1 = P G 14 A (κ) = 1 ≤ ν 13,14 (κ). Proof.…”