Leakage-Resilient Non-malleable Codes

Abstract

A recent trend in cryptography is to construct cryptosystems that are secure against physical attacks. Such attacks are usually divided into two classes: the leakage attacks in which the adversary obtains some information about the internal state of the machine, and the tampering attacks where the adversary can modify this state. One of the popular tools used to provide tamper-resistance are the non-malleable codes introduced by Dziembowski, Pietrzak and Wichs (ICS 2010). These codes can be defined in several variants, but arguably the most natural of them are the information-theoretically secure codes in the k-split-state model (the most desired case being k = 2).Such codes were constucted recently by Aggarwal et al. (STOC 2014). Unfortunately, unlike the earlier, computationally-secure constructions (Liu and Lysyanskaya, CRYPTO 2012) these codes are not known to be resilient to leakage. This is unsatisfactory, since in practice one always aims at providing resilience against both leakage and tampering (especially considering tampering without leakage is problematic, since the leakage attacks are usually much easier to perform than the tampering attacks).In this paper we close this gap by showing a non-malleable code in the 2-split state model that is secure against leaking almost a 1/12-th fraction of the bits from the codeword (in the bounded-leakage model). This is achieved via a generic transformation that takes as input any non-malleable code (Enc, Dec) in the 2-split state model, and constructs out of it another nonmalleable code (Enc , Dec ) in the 2-split state model that is additionally leakage-resilient. The rate of (Enc , Dec ) is linear in the rate of (Enc, Dec). Our construction requires that Dec is symmetric, i.e., for all x, y, it is the case that Dec(x, y) = Dec(y, x), but this property holds for all currently known information-theoretically secure codes in the 2-split state model. In particular, we can apply our transformation to the code of Aggarwal et al., obtaining the first leakage-resilient code secure in the split-state model. Our transformation can be applied to other codes (in particular it can also be applied to a recent code of Aggarwal, Dodis, Kazana and Obremski constructed in the work subsequent to this one).

From Single-Bit to Multi-bit Public-Key Encryption via Non-malleable Codes

“…Beyond the constructions of [23,9,25], non-malleable codes exists against block-wise tampering [11], against bit-wise tampering and permutations [5,4], against split-state tampering-both information-theoretic [22,2,7,3,1] and computational [38,18]-and in a setting where the computational complexity of the tampering functions is limited [8,27,34]. We stress that the typical application of non-malleable codes is to protect cryptographic schemes against memory tampering (see, e.g., [29,23,19,20]).…”

“…3 Reductions. When relating two distinguishing problems, it is convenient to use a special type of system C that translates one setting into the other.…”

“…A slight modification of protocol 1-pke yields the protocol 1-pke for construction (3). Essentially, all public keys are concatenated and sent via a single ←−•.…”

Continuously Non-Malleable Codes in the Split-State Model from Minimal Assumptions

“…The small mutual information of [6]. The number of leakage queries is proportional to the number of look-ahead threads, and thus to the number of errors done by the reduction when giving optimistic answers.…”

“…We refer the reader to §1.5 for an overview of known constructions of non-malleable codes for different classes Φ. Previous work showed how to construct split-state non-malleable codes, both for the information-theoretic setting [27,25,4,18,6,3,13,7,37] and the computational setting [38,30,22,2].…”