Linear-Time Non-Malleable Codes in the Bit-Wise Independent Tampering Model

Abstract

Non-malleable codes were introduced by Dziembowski et al. (ICS 2010) as coding schemes that protect a message against tampering attacks. Roughly speaking, a code is non-malleable if decoding an adversarially tampered encoding of a message ${\varvec{m}}$ produces the original message ${\varvec{m}}$ or a value ${\varvec{m}}'$ (possibly $\bot$) completely unrelated to ${\varvec{m}}$. It is known that non-malleability is possible only for restricted classes of tampering functions. Since their introduction, a long line of works has established feasibility results of non-malleable codes against different families of tampering functions. However, for many interesting families the challenge of finding “good” non-malleable codes remains open. In particular, we would like to have explicit constructions of non-malleable codes with high-rate and efficient encoding/decoding algorithms (i.e. low computational complexity). In this work we present two explicit constructions: the first one is a natural generalization of the work of Dziembowski et al. and gives rise to the first constant-rate non-malleable code with linear-time complexity (in a model including bit-wise independent tampering). The second construction is inspired by the recent works about non-malleable codes of Agrawal et al. (TCC 2015) and of Cheraghchi and Guruswami (TCC 2014) and improves our previous result in the bit-wise independent tampering model: it builds the first non-malleable codes with linear-time complexity and optimal-rate (i.e. rate $1 - o(1)$).

A Appendix

1.1 A.1 Tellegen’s Principle

We will briefly discuss a technique know as Tellegen’s principle. Assume that we are given a linear algorithm $\mathsf {T}$ computing the function $f({\varvec{x}}) = {\varvec{x}}\cdot {\varvec{A}}$, where ${\varvec{A}}$ is a $m \times n$ matrix over some ring R and ${\varvec{x}}$ is a vector from $R^n$. Then we can transform $\mathsf {T}$ into an algorithm $\mathsf {T}'$ computing the function $f'({\varvec{y}}) = {\varvec{y}}\cdot {\varvec{A}}^\top$, where ${\varvec{y}} \in R^m$ and ${\varvec{A}}^\top$ is the transpose of the matrix ${\varvec{A}}$, which has the same computational complexity as $\mathsf {T}$. We will discuss this transformation for arithmetic circuits. We can decompose a circuit into a sequence of elementary instructions $\phi _i$, where each $\phi _i$ is a linear transformation on all the wires. We can thus write the matrix ${\varvec{A}}$ as ${\varvec{A}} = \phi _n \cdot \phi _{n-1} \cdots \phi _2 \cdot \phi _1.$ Transposing ${\varvec{A}}$ immediately yields ${\varvec{A}}^\top = \phi _1^\top \cdot \phi _2^\top \cdots \phi _{n-1}^\top \cdot \phi _n^\top$. Thus, we only have to consider the effect of transposition to the elementary instructions $\phi _i$.

• Instruction $\phi _i$ multiplies a wire ${\varvec{x}}$ with a constant $\alpha \in R$ and writes the output in the same register. In this case $\phi _i^\top = \phi _i$, as the transformation matrix $\phi _i$ is diagonal and thus symmetric.

• Instruction $\phi _i$ adds wire ${\varvec{y}}$ to wire ${\varvec{x}}$. In this case $\phi _i^\top$ adds wire ${\varvec{x}}$ to wire ${\varvec{y}}$.

These two instructions are sufficient to implement any linear transformation. For instance, to clear an (auxiliary) register, simply multiply it by 0. We summarize this in the following Lemma.

Lemma 10

(Tellegen’s Principle [42]). Let $\mathsf {T}({\varvec{x}})$ be a linear arithmetic circuit or linear RAM algorithm computing the function ${\varvec{x}}\cdot {\varvec{A}}$. Then there exists a linear arithmetic circuit $\mathsf {T}'({\varvec{y}})$ that computes the function ${\varvec{y}}\cdot {\varvec{A}}^\top$ and has the same computational complexity as $\mathsf {T}$.