17 research outputs found
A Quantum-Proof Non-Malleable Extractor, With Application to Privacy Amplification against Active Quantum Adversaries
In privacy amplification, two mutually trusted parties aim to amplify the
secrecy of an initial shared secret in order to establish a shared private
key by exchanging messages over an insecure communication channel. If the
channel is authenticated the task can be solved in a single round of
communication using a strong randomness extractor; choosing a quantum-proof
extractor allows one to establish security against quantum adversaries.
In the case that the channel is not authenticated, Dodis and Wichs (STOC'09)
showed that the problem can be solved in two rounds of communication using a
non-malleable extractor, a stronger pseudo-random construction than a strong
extractor.
We give the first construction of a non-malleable extractor that is secure
against quantum adversaries. The extractor is based on a construction by Li
(FOCS'12), and is able to extract from source of min-entropy rates larger than
. Combining this construction with a quantum-proof variant of the
reduction of Dodis and Wichs, shown by Cohen and Vidick (unpublished), we
obtain the first privacy amplification protocol secure against active quantum
adversaries
Randomness Extractors -- An Exposition
Randomness is crucial to computer science, both in theory and applications. In complexity theory, randomness augments computers to offer more powerful models. In cryptography, randomness is essential for seed generation, where the computational model used is generally probabilistic. However, ideal randomness, which is usually assumed to be available in computer science theory and applications, might not be available to real systems. Randomness extractors are objects that turn âweakâ randomness into almost âidealâ randomness (pseudorandomness). In this paper, we will build the framework to work with such objects and present explicit constructions. We will discuss a well-known construction of seeded extractors via universal hashing and present a simple argument to extend such results to two-source extractors
An entropy lower bound for non-malleable extractors
A (k, Δ)-non-malleable extractor is a function nmExt : {0, 1} n Ă {0, 1} d â {0, 1} that takes two inputs, a weak source X ~ {0, 1} n of min-entropy k and an independent uniform seed s E {0, 1} d , and outputs a bit nmExt(X, s) that is Δ-close to uniform, even given the seed s and the value nmExt(X, s') for an adversarially chosen seed s' â s. Dodis and Wichs (STOC 2009) showed the existence of (k, Δ)-non-malleable extractors with seed length d = log(n - k - 1) + 2 log(1/Δ) + 6 that support sources of min-entropy k > log(d) + 2 log(1/Δ) + 8. We show that the foregoing bound is essentially tight, by proving that any (k, Δ)-non-malleable extractor must satisfy the min-entropy bound k > log(d) + 2 log(1/Δ) - log log(1/Δ) - C for an absolute constant C. In particular, this implies that non-malleable extractors require min-entropy at least Ω(loglog(n)). This is in stark contrast to the existence of strong seeded extractors that support sources of min-entropy k = O(log(1/Δ)). Our techniques strongly rely on coding theory. In particular, we reveal an inherent connection between non-malleable extractors and error correcting codes, by proving a new lemma which shows that any (k, Δ)-non-malleable extractor with seed length d induces a code C â {0,1} 2k with relative distance 1/2 - 2Δ and rate d-1/2k
Non-Malleable Extractors - New Tools and Improved Constructions
A non-malleable extractor is a seeded extractor with a very strong guarantee - the output of a non-malleable extractor obtained using a typical seed is close to uniform even conditioned on the output obtained using any other seed. The first contribution of this paper consists of two new and improved constructions of non-malleable extractors:
- We construct a non-malleable extractor with seed-length O(log(n) * log(log(n))) that works for entropy Omega(log(n)). This improves upon a recent exciting construction by Chattopadhyay, Goyal, and Li (STOC\u2716) that has seed length O(log^{2}(n)) and requires entropy Omega(log^{2}(n)).
- Secondly, we construct a non-malleable extractor with optimal seed length O(log(n)) for entropy n/log^{O(1)}(n). Prior to this construction, non-malleable extractors with a logarithmic seed length, due to Li (FOCS\u2712), required entropy 0.49*n. Even non-malleable condensers with seed length O(log(n)), by Li (STOC\u2712), could only support linear entropy.
We further devise several tools for enhancing a given non-malleable extractor in a black-box manner. One such tool is an algorithm that reduces the entropy requirement of a non-malleable extractor at the expense of a slightly longer seed. A second algorithm increases the output length of a non-malleable extractor from constant to linear in the entropy of the source. We also devise an algorithm that transforms a non-malleable extractor to the so-called t-non-malleable extractor for any desired t. Besides being useful building blocks for our constructions, we consider these modular tools to be of independent interest
Affine-malleable Extractors, Spectrum Doubling, and Application to Privacy Amplification
The study of seeded randomness extractors is a major line of research in theoretical computer science. The goal is to construct deterministic algorithms which can take a ``weak random source with min-entropy and a uniformly random seed of length , and outputs a string of length close to that is close to uniform and independent of . Dodis and Wichs~\cite{DW09} introduced a generalization of randomness extractors called non-malleable extractors (\nmExt) where \nmExt(X,Y) is close to uniform and independent of and \nmExt(X,f(Y)) for any function with no fixed points.
We relax the notion of a non-malleable extractor and introduce what we call an affine-malleable extractor (\AmExt: \F^n \times \F^d \mapsto \F) where \AmExt(X,Y) is close to uniform and independent of and has some limited dependence of \AmExt(X,f(Y)) - that conditioned on , (\AmExt(X,Y), \AmExt(X,f(Y))) is close to where is uniformly distributed in \F and A, B \in \F are random variables independent of \F.
We show under a plausible conjecture in additive combinatorics (called the Spectrum Doubling Conjecture) that the inner-product function \IP{\cdot,\cdot}:\F^n \times \F^n \mapsto \F is an affine-malleable extractor. As a modest justification of the conjecture, we show that a weaker version of the conjecture is implied by the widely believed Polynomial Freiman-Ruzsa conjecture.
We also study the classical problem of privacy amplification, where two parties Alice and Bob share a weak secret of min-entropy , and wish to agree on secret key of length over a public communication channel completely controlled by a computationally unbounded attacker Eve. The main application of non-malleable extractors and its many variants has been in constructing secure privacy amplification protocols.
We show that affine-malleable extractors along with affine-evasive sets can also be used to construct efficient privacy amplification protocols. We show that our protocol, under the Spectrum Doubling Conjecture, achieves near optimal parameters and achieves additional security properties like source privacy that have been the focus of some recent results in privacy amplification
Quantum secure non-malleable-extractors
We construct several explicit quantum secure non-malleable-extractors. All
the quantum secure non-malleable-extractors we construct are based on the
constructions by Chattopadhyay, Goyal and Li [2015] and Cohen [2015].
1) We construct the first explicit quantum secure non-malleable-extractor for
(source) min-entropy ( is the length of the source and is the error
parameter). Previously Aggarwal, Chung, Lin, and Vidick [2019] have shown that
the inner-product based non-malleable-extractor proposed by Li [2012] is
quantum secure, however it required linear (in ) min-entropy and seed
length.
Using the connection between non-malleable-extractors and privacy
amplification (established first in the quantum setting by Cohen and Vidick
[2017]), we get a -round privacy amplification protocol that is secure
against active quantum adversaries with communication , exponentially improving upon the
linear communication required by the protocol due to [2019].
2) We construct an explicit quantum secure -source non-malleable-extractor
for min-entropy , with an output of size
and error .
3) We also study their natural extensions when the tampering of the inputs is
performed -times. We construct explicit quantum secure
-non-malleable-extractors for both seeded () as well as
-source case ()
Non-Malleable Extractors and Codes, with their Many Tampered Extensions
Randomness extractors and error correcting codes are fundamental objects in
computer science. Recently, there have been several natural generalizations of
these objects, in the context and study of tamper resilient cryptography. These
are seeded non-malleable extractors, introduced in [DW09]; seedless
non-malleable extractors, introduced in [CG14b]; and non-malleable codes,
introduced in [DPW10].
However, explicit constructions of non-malleable extractors appear to be
hard, and the known constructions are far behind their non-tampered
counterparts.
In this paper we make progress towards solving the above problems. Our
contributions are as follows.
(1) We construct an explicit seeded non-malleable extractor for min-entropy
. This dramatically improves all previous results and gives a
simpler 2-round privacy amplification protocol with optimal entropy loss,
matching the best known result in [Li15b].
(2) We construct the first explicit non-malleable two-source extractor for
min-entropy , with output size and
error .
(3) We initiate the study of two natural generalizations of seedless
non-malleable extractors and non-malleable codes, where the sources or the
codeword may be tampered many times. We construct the first explicit
non-malleable two-source extractor with tampering degree up to
, which works for min-entropy , with
output size and error . We show that we can
efficiently sample uniformly from any pre-image. By the connection in [CG14b],
we also obtain the first explicit non-malleable codes with tampering degree
up to , relative rate , and error
.Comment: 50 pages; see paper for full abstrac
Privacy Amplification with Asymptotically Optimal Entropy Loss
We study the problem of ``privacy amplification\u27\u27: key agreement
between two parties who both know a weak secret w, such as a
password. (Such a setting is ubiquitous on the internet, where
passwords are the most commonly used security device.) We assume
that the key agreement protocol is taking place in the presence of
an active computationally unbounded adversary Eve. The adversary may
have partial knowledge about w, so we assume only that w has
some entropy from Eve\u27s point of view. Thus, the goal of the
protocol is to convert this non-uniform secret w into a uniformly
distributed string that is fully secret from Eve. R may then
be used as a key for running symmetric cryptographic protocols (such
as encryption, authentication, etc.).
Because we make no computational assumptions, the entropy in R can
come only from w. Thus such a protocol must minimize the entropy
loss during its execution, so that R is as long as possible. The
best previous results have entropy loss of , where
is the security parameter, thus requiring the password to
be very long even for small values of . In this work, we
present the first protocol for information-theoretic key agreement
that has entropy loss LINEAR in the security parameter. The
result is optimal up to constant factors. We achieve our improvement
through a somewhat surprising application of error-correcting codes
for the edit distance.
The protocol can be extended to provide also ``information
reconciliation,\u27\u27 that is, to work even when the two parties have slightly different versions of w (for example, when biometrics are involved)
Correlated-Source Extractors and Cryptography with Correlated-Random Tapes
In this paper, we consider the setting where a party uses correlated random tapes across multiple executions of a cryptographic algorithm. We ask if the security properties could still be preserved in such a setting. As examples, we introduce the notion of correlated-tape zero knowledge, and, correlated-tape multi-party computation, where, the zero-knowledge property, and, the ideal/real model security must still be preserved even if a party uses correlated random tapes in multiple executions.
Our constructions are based on a new type of randomness extractor which we call correlated-source extractors. Correlated-source extractors can be seen as a dual of non-malleable extractors, and, allow an adversary to choose several tampering functions which are applied to the randomness source. Correlated-source extractors guarantee that even given the output of the extractor on the tampered sources, the output on the original source is still uniformly random. Given (seeded) correlated-source extractors, and, resettably-secure computation protocols, we show how to directly get a positive result for both correlated-tape zero-knowledge and correlated-tape multi-party computation in the CRS model. This is tight considering the known impossibility results on cryptography with imperfect randomness.
Our main technical contribution is an explicit construction of a correlated-source extractor where the length of the seed is independent of the number of tamperings. Additionally, we also provide a (non-explicit) existential result for correlated source extractors with almost optimal parameters