Privacy Amplification and Nonmalleable Extractors Via Character Sums

Abstract

Abstract. In studying how to communicate over a public channel with an active adversary, Dodis and Wichs introduced the notion of a non-malleable extractor. A non-malleable extractor dramatically strengthens the notion of a strong extractor. A strong extractor takes two inputs, a weakly-random x and a uniformly random seed y, and outputs a string which appears uniform, even given y. For a non-malleable extractor nmExt, the output nmExt(x, y) should appear uniform given y as well as nmExt(x, A(y)), where A is an arbitrary function with A(y) = y.We show that an extractor introduced by Chor and Goldreich is non-malleable when the entropy rate (the ratio between the entropy and the length of the weakly random string) is above half. It outputs a linear number of bits when the entropy rate is 1/2+α, for any α > 0. Previously, no explicit construction was known for any entropy rate less than 1. To achieve a polynomial running time when outputting more than one bits, we rely on a widely-believed conjecture about the distribution of prime numbers in arithmetic progressions. Our analysis involves character sum estimates, which may be of independent interest.Using our non-malleable extractor, we obtain protocols for "privacy amplification": key agreement between two parties who share a weakly-random secret. Our protocols work in the presence of an active adversary with unlimited computational power, and have asymptotically optimal entropy loss. When the secret has entropy rate greater than 1/2, the protocol follows from a result of Dodis and Wichs, and takes two (or three; for strongest security guarantees) rounds. When the secret has entropy rate δ for any constant δ > 0, our new protocol takes a constant (polynomial in 1/δ) number of rounds. Our protocols run in polynomial time under the above well-known conjecture about primes.

Non-malleable Extractors with Short Seeds and Applications to Privacy Amplification

“…Recently, Dodis, Li, Wooley, and Zuckerman [7] presented the first explicit construction of a non-malleable extractor. They showed that an extractor introduced by Chor and Goldriech in the context of two-source extractors [5] is non-malleable as long as the weak source has min-entropy rate 1/2 + δ for an arbitrarily small constant δ > 0.…”

“…Using their look-ahead extractor, Dodis and Wichs constructed an explicit 2-round privacy amplification protocol with entropy loss βk + O(log 2 n + log 2 (1/ )), for an arbitrarily small constant β > 0, and communication complexity O(log 2 n+log 2 (1/ )), both of which are somewhat far from optimal 2 . Dodis, Li, Wooley, and Zuckerman [7] showed that when instantiating the protocol of Dodis and Wichs with their explicit non-malleable extractor one obtains a 2-round privacy amplification protocol for weak sources of min-entropy rate 1/2 + δ, for an arbitrarily small constant δ > 0, with entropy loss O(log n + log(1/ )). However, since the seed of the extractor is of length Ω(n) bits, the resulting privacy amplification protocol suffers from communication complexity of Ω(n) bits.…”

“…This should be compared with the extractor of [7] that uses a seed of length Ω(n) bits. This improvement in the seed length is crucial for the communication complexity of the resulting privacy amplification protocols.…”

“…A non-malleable extractor is a function nmExt : {0, 1} n × {0, 1} d → {0, 1} m that takes two inputs: a weak source W and a uniform (independent) seed S, and outputs a string nmExt(W, S) that is nearly uniform given S as well as nmExt(W, S ) for any seed S = S that is determined as an arbitrary function of S.The first explicit construction of a non-malleable extractor was recently provided by Dodis, Li, Wooley and Zuckerman [7]. Their extractor works for any weak source with min-entropy rate 1/2+δ, where δ > 0 is an arbitrary constant, and outputs up to a linear number of bits, but suffers from two drawbacks.…”

“…The first explicit construction of a non-malleable extractor was recently provided by Dodis, Li, Wooley and Zuckerman [7]. Their extractor works for any weak source with min-entropy rate 1/2+δ, where δ > 0 is an arbitrary constant, and outputs up to a linear number of bits, but suffers from two drawbacks.…”