Optimal Computational Split-state Non-malleable Codes

Abstract

Abstract. Non-malleable codes are a generalization of classical errorcorrecting codes where the act of "corrupting" a codeword is replaced by a "tampering" adversary. Non-malleable codes guarantee that the message contained in the tampered codeword is either the original message m, or a completely unrelated one. In the common split-state model, the codeword consists of multiple blocks (or states) and each block is tampered with independently. The central goal in the split-state model is to construct high rate nonmalleable codes against all functions with only two states (which are necessary). Following a series of long and impressive line of work, constant rate, two-state, non-malleable codes against all functions were recently achieved by Aggarwal et al. (STOC 2015). Though constant, the rate of all known constructions in the split state model is very far from optimal (even with more than two states). In this work, we consider the question of improving the rate of split-state non-malleable codes. In the "information theoretic" setting, it is not possible to go beyond rate 1/2. We therefore focus on the standard computational setting. In this setting, each tampering function is required to be efficiently computable, and the message in the tampered codeword is required to be either the original message m or a "computationally" independent one. In this setting, assuming only the existence of one-way functions, we present a compiler which converts any poor rate, two-state, (sufficiently strong) non-malleable code into a rate-1, two-state, computational nonmalleable code. These parameters are asymptotically optimal. Furthermore, for the qualitative optimality of our result, we generalize the result of Cheraghchi and Guruswami (ITCS 2014) to show that the existence of one-way functions is necessary to achieve rate > 1/2 for such codes. Our compiler requires a stronger form of non-malleability, called augmented non-malleability. This notion requires a stronger simulation guarantee for non-malleable codes and simplifies their modular usage in cryptographic settings where composition occurs. Unfortunately, this form of non-malleability is neither straightforward nor generally guaranteed by known results. Nevertheless, we prove this stronger form of nonmalleability for the two-state construction of Aggarwal, Dodis, and Lovett (STOC 14). This result is of independent interest.

Continuously Non-Malleable Codes in the Split-State Model from Minimal Assumptions

“…Interesting open questions related to our work are, for instance, whether continuous non-malleability can be achieved, under minimal assumptions, together with additional properties, such as strong non-malleability [27], supernon-malleability [32], augmented non-malleability [2], and locality [22,13,21], or whether the rate of our code construction can be improved.…”

“…We refer the reader to §1.5 for an overview of known constructions of non-malleable codes for different classes Φ. Previous work showed how to construct split-state non-malleable codes, both for the information-theoretic setting [27,25,4,18,6,3,13,7,37] and the computational setting [38,30,22,2].…”

Non-Malleable Codes for Partial Functions with Manipulation Detection

“…Non-malleable codes for other function classes have been extensively studied, such as constant split-state functions [17,25], block-wise tampering [15,19], while the work of [2] develops beautiful connections among various function classes. In addition, other variants of non-malleable codes have been proposed, such as continuous non-malleable codes [30], augmented non-malleable codes [1], locally decodable/updatable non-malleable codes [16,[22][23][24]31], and non-malleable codes with split-state refresh [28]. In [7] the authors consider AC0 circuits, bounded-depth decision trees and streaming, space-bounded adversaries.…”

“…The current state of the art in the computational setting considers tools such as (Authenticated) Encryption [1,22,24,28,36,37], non-interactive zeroknowledge (NIZK) proofs [22,28,30,37], and -more extractable collision resistant hashes (ECRH) [36], where others use KEM/DEM techniques [1,24]. Those constructions share a common structure, incorporating a short secret key sk (or a short encoding of it), as well as a long ciphertext, e, and a proof π (or a hash value).…”

“…Then, it is not hard to see that non-malleability falls apart as the security of the encryption no longer holds. The attack requires access rate only O((|sk|)/(|sk| + |e| + |π|)), for [22,28,37] and O(poly(k)/|s|) for [1,24,36]. A similar attack applies to [30], which is in the continual setting.…”