[Paper Review] Non-Malleable Extractors and Codes, with their Many Tampered Extensions

Eshan Chattopadhyay, Vipul Goyal+1 more|arXiv (Cornell University)|May 1, 2015

Cryptography and Data Security3 citations

TL;DR

This paper presents explicit constructions of non-malleable extractors and codes resilient to multiple tampering attacks, achieving optimal parameters for seeded and two-source extractors with min-entropy $k \geq \log^2 n$ and $k \geq n - n^{\Omega(1)}$, respectively. It introduces novel techniques to ensure output independence under tampering, enabling the first efficient pre-image sampling and constructing non-malleable codes with high tampering resilience and constant-rate error.

ABSTRACT

Randomness extractors and error correcting codes are fundamental objects in computer science. Recently, there have been several natural generalizations of these objects, in the context and study of tamper resilient cryptography. These are seeded non-malleable extractors, introduced in [DW09]; seedless non-malleable extractors, introduced in [CG14b]; and non-malleable codes, introduced in [DPW10]. However, explicit constructions of non-malleable extractors appear to be hard, and the known constructions are far behind their non-tampered counterparts. In this paper we make progress towards solving the above problems. Our contributions are as follows. (1) We construct an explicit seeded non-malleable extractor for min-entropy $k \geq \log^2 n$. This dramatically improves all previous results and gives a simpler 2-round privacy amplification protocol with optimal entropy loss, matching the best known result in [Li15b]. (2) We construct the first explicit non-malleable two-source extractor for min-entropy $k \geq n-n^{Ω(1)}$, with output size $n^{Ω(1)}$ and error $2^{-n^{Ω(1)}}$. (3) We initiate the study of two natural generalizations of seedless non-malleable extractors and non-malleable codes, where the sources or the codeword may be tampered many times. We construct the first explicit non-malleable two-source extractor with tampering degree $t$ up to $n^{Ω(1)}$, which works for min-entropy $k \geq n-n^{Ω(1)}$, with output size $n^{Ω(1)}$ and error $2^{-n^{Ω(1)}}$. We show that we can efficiently sample uniformly from any pre-image. By the connection in [CG14b], we also obtain the first explicit non-malleable codes with tampering degree $t$ up to $n^{Ω(1)}$, relative rate $n^{Ω(1)}/n$, and error $2^{-n^{Ω(1)}}$.

Motivation & Objective

• Address the lack of explicit constructions for non-malleable extractors, especially in the two-source and seedless settings.
• Overcome the limitation of existing non-malleable codes that only tolerate a single tampering, by enabling resilience to multiple tamperings.
• Develop a unified framework for non-malleable extractors and codes under many-tampering scenarios, extending prior work on tamper resilience.
• Achieve optimal entropy loss and error bounds in privacy amplification protocols using the new extractors.
• Enable efficient pre-image sampling for non-malleable extractors, which is crucial for cryptographic applications like non-malleable secret sharing.

Proposed method

• Construct a seeded non-malleable extractor for min-entropy $k \geq \log^2 n$ using a novel combination of extractors and error-correcting code properties.
• Design a non-malleable two-source extractor for sources with min-entropy $k \geq n - n^{\Omega(1)}$, leveraging algebraic geometry and randomness extraction over finite fields.
• Introduce the concept of tampering degree $t$ up to $n^{\Omega(1)}$, generalizing the single-tamper model to multiple adversarial tamperings.
• Use Reed-Solomon codes and their submatrix properties to model the tampering behavior and ensure output independence via rank-based subspace arguments.
• Apply the rank-nullity theorem to show that pre-images under tampered inputs lie in subspaces of fixed size, enabling uniform sampling.
• Construct an efficient sampling procedure $\textnormal{Samp}_{nm}$ that uniformly samples from the pre-image of any output, independent of the input to the sampler.

Experimental results

Research questions

• RQ1 Can we construct an explicit seeded non-malleable extractor for min-entropy $k \geq \log^2 n$ with optimal entropy loss?
• RQ2 Is it possible to build a non-malleable two-source extractor for sources with almost full min-entropy and sub-exponential error?
• RQ3 Can non-malleable extractors and codes be generalized to withstand multiple tamperings, rather than just one?
• RQ4 What is the maximal tampering degree $t$ for which non-malleable extractors and codes remain secure and efficient?
• RQ5 Can we efficiently sample from the pre-image of a non-malleable extractor’s output, even under adversarial tampering?

Key findings

• An explicit seeded non-malleable extractor is constructed for min-entropy $k \geq \log^2 n$, achieving optimal entropy loss and enabling a 2-round privacy amplification protocol with optimal parameters.
• The first explicit non-malleable two-source extractor is constructed for min-entropy $k \geq n - n^{\Omega(1)}$, with output size $n^{\Omega(1)}$ and error $2^{-n^{\Omega(1)}}$.
• A non-malleable two-source extractor is constructed for tampering degree $t$ up to $n^{\Omega(1)}$, maintaining the same error and output size as the single-tamper case.
• The paper provides an efficient procedure to sample uniformly from any pre-image of the non-malleable extractor, a key requirement for cryptographic applications.
• By leveraging the connection in [CG14b], the first explicit non-malleable codes are constructed with tampering degree $t \leq n^{\Omega(1)}$, relative rate $n^{\Omega(1)}/n$, and error $2^{-n^{\Omega(1)}}$.
• The size of the pre-image of any output under the non-malleable extractor is independent of the input to the sampling procedure, ensuring uniformity and correctness.