Non-malleable extractors and symmetric key cryptography from weak secrets

Abstract

We study the question of basing symmetric key cryptography on weak secrets. In this setting, Alice and Bob share an n-bit secret W , which might not be uniformly random, but the adversary has at least k bits of uncertainty about it (formalized using conditional min-entropy). Since standard symmetrickey primitives require uniformly random secret keys, we would like to construct an authenticated key agreement protocol in which Alice and Bob use W to agree on a nearly uniform key R, by communicating over a public channel controlled by an active adversary Eve. We study this question in the information theoretic setting where the attacker is computationally unbounded. We show that single-round (i.e. one message) protocols do not work when k ≤ n 2 , and require poor parameters even when n 2 < k n. On the other hand, for arbitrary values of k, we design a communication efficient two-round (challenge-response) protocol extracting nearly k random bits. This dramatically improves the previous construction of Renner and Wolf [RW03], which requires Θ(λ + log(n)) rounds where λ is the security parameter. Our solution takes a new approach by studying and constructing "non-malleable" seeded randomness extractors -if an attacker sees a random seed X and comes up with an arbitrarily related seed X , then we bound the relationship between R = Ext(W ; X) and R = Ext(W ; X ).We also extend our two-round key agreement protocol to the "fuzzy" setting, where Alice and Bob share "close" (but not equal) secrets W A and W B , and to the Bounded Retrieval Model (BRM) where the size of the secret W is huge.

Efficient Non-malleable Codes and Key-Derivation for Poly-size Tampering Circuits

“…While we believe that non-malleable key derivation is an interesting notion on its own (e.g., it can be viewed as a dual version of non-malleable extractors [17]), we also show it has useful applications for tamper resilience. For instance, consider some cryptographic scheme G using a uniform key in y ← {0, 1} k .…”

“…Note that the above definition can be interpreted as a dual version of the definition of nonmalleable extractors [17]. 2 The theorem below states that by sampling a function h from a set H of t-wise independent hash functions, we obtain a non-malleable key derivation function with overwhelming probability.…”

Overcoming Weak Expectations

“…Next, we consider the case of q = 2, where the notion of (2, ε)-wise independence in the k = (m − d)-real 2 model becomes a non-malleable extractor [14] (for Renyi entropy; the case q = 1 collapses to the setting of weak PRF considered in the previous section).…”

Additive Combinatorics: With a View Towards Computer Science and Cryptography—An Exposition

“…Randomness extractors are widely used in cryptographic applications (see, e.g., [25,87,99,100,199,200,218,348]). This includes applications in construction of pseudorandom generators from one-way functions, design of cryptographic functionalities from noisy and weak sources, construction of key derivation functions, and extracting many private bits even when the adversary knows all except log Ω(1) n of the n bits [251] (see also [250]).…”