Non-malleable Codes from Two-Source Extractors

  • Stefan Dziembowski
  • Tomasz Kazana
  • Maciej Obremski
Conference paper

DOI: 10.1007/978-3-642-40084-1_14

Part of the Lecture Notes in Computer Science book series (LNCS, volume 8043)
Cite this paper as:
Dziembowski S., Kazana T., Obremski M. (2013) Non-malleable Codes from Two-Source Extractors. In: Canetti R., Garay J.A. (eds) Advances in Cryptology – CRYPTO 2013. Lecture Notes in Computer Science, vol 8043. Springer, Berlin, Heidelberg

Abstract

We construct an efficient information-theoretically non-malleable code in the split-state model for one-bit messages. Non-malleable codes were introduced recently by Dziembowski, Pietrzak and Wichs (ICS 2010), as a general tool for storing messages securely on hardware that can be subject to tampering attacks. Informally, a code \((\mathsf{Enc} : {\cal M} \rightarrow {\cal L} \times {\cal R}, \mathsf{Dec} : {\cal L} \times {\cal R} \rightarrow {\cal M})\) is non-malleable in the split-state model if any adversary, by manipulating independentlyL and R (where (L,R) is an encoding of some message M), cannot obtain an encoding of a message M′ that is not equal to M but is “related” M in some way. Until now it was unknown how to construct an information-theoretically secure code with such a property, even for \({\cal M} = \{0,1\}\). Our construction solves this problem. Additionally, it is leakage-resilient, and the amount of leakage that we can tolerate can be an arbitrary fraction ξ < 1/4 of the length of the codeword. Our code is based on the inner-product two-source extractor, but in general it can be instantiated by any two-source extractor that has large output and has the property of being flexible, which is a new notion that we define.

We also show that the non-malleable codes for one-bit messages have an equivalent, perhaps simpler characterization, namely such codes can be defined as follows: if M is chosen uniformly from {0,1} then the probability (in the experiment described above) that the output message M′ is not equal to M can be at most 1/2 + ε.

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

Copyright information

© International Association for Cryptologic Research 2013

Authors and Affiliations

  • Stefan Dziembowski
    • 1
    • 2
  • Tomasz Kazana
    • 2
  • Maciej Obremski
    • 2
  1. 1.Sapienza University of RomeItaly
  2. 2.University of WarsawPoland

Personalised recommendations