Non-malleable extractors and codes, with their many tampered extensions

Abstract

Randomness extractors and error correcting codes are fundamental objects in computer science. Recently, there have been several natural generalizations of these objects, in the context and study of tamper resilient cryptography. These are seeded non-malleable extractors, introduced by Dodis and Wichs [DW09]; seedless non-malleable extractors, introduced by Cheraghchi and Guruswami [CG14b]; and non-malleable codes, introduced by Dziembowski, Pietrzak and Wichs [DPW10]. Besides being interesting on their own, they also have important applications in cryptography. For example, seeded non-malleable extractors are closely related to privacy amplification with an active adversary, non-malleable codes are related to non-malleable secret sharing, and seedless non-malleable extractors provide a universal way to construct explicit non-malleable codes.However, explicit constructions of non-malleable extractors appear to be hard, and the known constructions are far behind their non-tampered counterparts. Indeed, the best known seeded non-malleable extractor requires min-entropy rate at least 0.49 [Li12b]; while explicit constructions of non-malleable two-source extractors were not known even if both sources have full min-entropy, and was left as an open problem in [CG14b]. In addition, current constructions of non-malleable codes in the information theoretic setting only deal with the situation where the codeword is tampered once, and may not be enough for certain applications.In this paper we make progress towards solving the above problems. Our contributions are as follows.• We construct an explicit seeded non-malleable extractor for min-entropy k ≥ log 2 n. This dramatically improves all previous results and gives a simpler 2-round privacy amplification protocol with optimal entropy loss, matching the best known result in [Li15a]. • We construct the first explicit non-malleable two-source extractor for min-entropy k ≥ n − n Ω(1) , with output size n Ω(1) and error 2 −n Ω(1) . • We motivate and initiate the study of two natural generalizations of seedless non-malleable extractors and non-malleable codes, where the sources or the codeword may be tampered many times. For this, we construct the first explicit non-malleable two-source extractor with tampering degree t up to n Ω(1) , which works for min-entropy k ≥ n − n Ω(1) , with output size n Ω(1) and error 2 −n Ω(1) . We further show that we can efficiently sample uniformly from any pre-image. By the connection in [CG14b], we also obtain the first explicit non-malleable codes with tampering degree t up to n Ω(1) , relative rate n Ω(1) /n, and error 2 −n Ω(1) .

Improved non-malleable extractors, non-malleable codes and independent source extractors

“…Since our new non-malleable extractor is better than the construction in [CGL16], which has seed length d = O(log 2 (n/ǫ ′ )), we can first assume that d = O(log 2 (n/ǫ)) and we will use the inequality d ≥ C ′ log a log(da/ǫ ′ ) to compute the minimum d and verify the condition that d = O(log 2 (n/ǫ ′ )) does hold. In this case, we see that log(da/ǫ ′ ) = log(O(log 3 (n/ǫ ′ )/ǫ ′ )) = O(log log(n/ǫ ′ ) + log(1/ǫ ′ )), and log a = O(log log(n/ǫ ′ )).…”

“…Since the construction of the non-malleable two-source extractor is complicated and involves multi steps of alternating extraction etc., it appears that the sampling procedure may also be complicated. Indeed, in [CGL16] the sampling procedure consists of a series of carefully designed steps to "invert" each intermediate extraction step. Here, we show that in fact we can significantly simplify the sampling procedure.…”

“…Here, we show that in fact we can significantly simplify the sampling procedure. In fact, we are going to treat most of the details in the construction of the non-malleable two-source extractor as a black box, and all we need are two ingredients from [CGL16]: First, a seeded extractor IExt : {0, 1} n × {0, 1} d → {0, 1} m with d = O(log(n/ǫ)) and m = Ω(d), such that for any fixed output s and any fixed seed r, one can efficiently uniformly sample from the pre-image (this is because for any fixed seed, the output is a linear function of the input source), and the pre-image always has the same size. Second, to obtain the advice, first we take a small slice X 1 of the source X, and a small slice Y 1 of the source Y .…”

“…The flip-flop function was constructed by Cohen [Coh15] using alternating extraction, based on a previous similar construction of the author [Li13a]. Subsequently, it was used in the construction of non-malleable extractors by Chattopadhyay, Goyal and Li [CGL16]. The flip-flop function is a basic version of correlation breaker, and (informally) uses an independent source X to break the correlation between two r.v's Y and Y ′ , given an advice bit.…”

Explicit Non-malleable Extractors, Multi-source Extractors, and Almost Optimal Privacy Amplification Protocols

“…The following flip-flop function was constructed by Cohen [Coh15] using alternating extraction. Subsequently, Chattopadhyay, Goyal and Li [CGL16], used this in constructing non-malleable extractors. Informally, the flip-flop function uses an independent source X to break the correlation between two r.v's Y and Y ′ , given an advice bit.…”