Non-Malleable Encryption: Simpler, Shorter, Stronger

Abstract

In a seminal paper, Dolev et al. [15] introduced the notion of non-malleable encryption (NM-CPA). This notion is very intriguing since it suffices for many applications of chosen-ciphertext secure encryption (IND-CCA), and, yet, can be generically built from semantically secure (IND-CPA) encryption, as was shown in the seminal works by Pass et al. [29] and by Choi et al. [9], the latter of which provided a black-box construction. In this paper we investigate three questions related to NM-CPA security:1. Can the rate of the construction by Choi et al. of NM-CPA from IND-CPA be improved? 2. Is it possible to achieve multi-bit NM-CPA security more efficiently from a single-bit NM-CPA scheme than from IND-CPA? 3. Is there a notion stronger than NM-CPA that has natural applications and can be achieved from IND-CPA security?We answer all three questions in the positive. First, we improve the rate in the construction of Choi et al. by a factor O(λ), where λ is the security parameter. Still, encrypting a message of size O(λ) would require ciphertext and keys of size O(λ 2 ) times that of the IND-CPA scheme, even in our improved scheme. Therefore, we show a more efficient domain extension technique for building a λ-bit NM-CPA scheme from a single-bit NM-CPA scheme with keys and ciphertext of size O(λ) times that of the NM-CPA one-bit scheme. To achieve our goal, we define and construct a novel type of continuous non-malleable code (NMC), called secret-state NMC, as we show that standard continuous NMCs are not enough for the natural "encode-then-encrypt-bit-by-bit" approach to work.Finally, we introduce a new security notion for public-key encryption (PKE) that we dub nonmalleability under (chosen-ciphertext) self-destruct attacks (NM-SDA). After showing that NM-SDA is a strict strengthening of NM-CPA and allows for more applications, we nevertheless show that both of our results-(faster) construction from IND-CPA and domain extension from one-bit scheme-also hold for our stronger NM-SDA security. In particular, the notions of IND-CPA, NM-CPA, and NM-SDA security are all equivalent, lying (plausibly, strictly?) below IND-CCA security.

Continuously Non-Malleable Codes in the Split-State Model from Minimal Assumptions

“…In this paper, we focus only on the "default flavor" of continuous non-malleability. This in contrast to previous work on continuously nonmalleable codes (except [20,19,28]), which instead by default considered continuous super non-malleability. While the notion we consider is strictly weaker than continuous strong or super non-malleability, to the best of our knowledge, it is sufficient for all known applications of continuously non-malleable codes, in particular [30,31,20,19,28].…”

“…The more general case of continuous non-malleability was introduced by Faust et al [30], with the goal of guaranteeing non-malleability even after multiple (adaptively chosen) tampering attempts; that is, the adversary is allowed to choose the tampering functions to apply in the next round based on the answers obtained in the previous rounds. As pointed out also in [30], continuously non-malleable codes (CNMCs) are arguably the most natural generalization of standard NMCs, and allow to significantly strengthen their applications [31,20,19].…”

“…Only a few constructions of continuously non-malleable codes are known (besides the already mentioned constructions of [30,28]). In particular, continuous non-malleability is known to be achievable in the informationtheoretic setting, for the simpler cases of bit-wise independent tampering [20,19] (where each bit of the codeword is tampered independently), and constant-state tampering [5]. Jafargholi and Wichs [36] obtain different flavors of continuous non-malleability for the case of tampering functions with high min-entropy or few fixed points.…”

Continuously non-malleable codes with split-state refresh

“…Several constructions of non-malleable codes in the split-state model appeared in the literature, both for the information-theoretic [32,31,3,20,4,2,14,5,48,49,17] and computational setting [50,36,24,1,46,52,23]. Non-malleable codes exist also for several other models besides split-state tampering, including bit-wise independent tampering and permutations [20,6,7,22,21], circuits of polynomial size [32,19,38,39], constant-state tampering [18], block-wise tampering [13], space-bounded algorithms [35,9], bounded-depth circuits [8,16], and partial functions [47].…”

Linear-Time Non-Malleable Codes in the Bit-Wise Independent Tampering Model

“…Recently, they also found application to computational cryptography Full version of this paper available at http://eprint.iacr.org/2016/397 (e.g. construction of non-malleable commitments [AGM + 15b], domain extension for public-key encryption schemes [CMTV15,CDTV16]). Roughly speaking, a coding scheme (Enc, Dec) is non-malleable with respect to the tampering function f if decoding f (Enc(m)) produces the original message m or a value m (eventually ⊥) completely unrelated with m. Moreover, the probability of which one of these two events happens is also independent of m. As an illustration of the notion, consider a key that is stored in a device.…”