Non-malleable Commitments Research Articles

An Algebraic Approach to Nonmalleability

In their seminal work on nonmalleable cryptography, Dolev, Dwork, and Naor showed how to construct a nonmalleable commitment with logarithmically-many “rounds''/``slots,” the idea being that any ad...

Two-Round and Non-Interactive Concurrent Non-Malleable Commitments from Time-Lock Puzzles

Non-malleable commitments are a fundamental cryptographic tool for preventing (concurrent) man-in-the-middle attacks. Since their invention by Dolev, Dwork, and Naor in 1991, their round-complexity...

Unprovable Security of Perfect NIZK and Non-interactive Non-malleable Commitments

We present barriers to provable security of two important cryptographic primitives, perfect non-interactive zero knowledge (NIZK) and non-interactive non-alleable commitments: źBlack-box reductions cannot be used to demonstrate adaptive soundness (i.e., that soundness holds even if the statement to be proven is chosen as a function of the common reference string) of any statistical NIZK for NP based on any standard intractability assumptions. źBlack-box reductions cannot be used to demonstrate non-malleability of non-interactive, or even 2-message, commitment schemes based on any standard intractability assumptions. We emphasize that the above separations apply even if the construction of the considered primitives makes a non-black-box use of the underlying assumption. As an independent contribution, we suggest a taxonomy of game-based intractability assumptions.

Linearly homomorphic structure-preserving signatures and their applications

Structure-preserving signatures (SPS) are signature schemes where messages, signatures and public keys all consist of elements of a group over which a bilinear map is efficiently computable. This property makes them useful in cryptographic protocols as they nicely compose with other algebraic tools (like the celebrated Groth---Sahai proof systems). In this paper, we consider SPS systems with homomorphic properties and suggest applications that have not been provided before (in particular, not by employing ordinary SPS). We build linearly homomorphic structure-preserving signatures under simple assumptions and show that the primitive makes it possible to verify the calculations performed by a server on outsourced encrypted data (i.e., combining secure computation and authenticated computation to allow reliable and secure cloud storage and computation, while freeing the client from retaining cleartext storage). Then, we give a generic construction of non-malleable (and actually simulation-sound) commitment from any linearly homomorphic SPS. This notably provides the first constant-size non-malleable commitment to group elements.

Constant-Round Nonmalleable Commitments from Any One-Way Function

We show unconditionally that the existence of commitment schemes implies the existence of constant-round nonmalleable commitments; earlier protocols required additional assumptions such as collision-resistant hash functions or subexponential one-way functions. Our protocol also satisfies the stronger notions of concurrent nonmalleability and robustness. As a corollary, we establish that constant-round nonmalleable zero-knowledge arguments for NP can be based on one-way functions and constant-round secure multiparty computation can be based on enhanced trapdoor permutations; also here, earlier protocols additionally required either collision-resistant hash functions or subexponential one-way functions.

A Multi-Trapdoor Commitment Scheme from the RSA Assumption

Gennaro introduced the notion of multi-trapdoor commitments which is a stronger form of trapdoor commitment schemes at CRYPTO 2004. Multi-trapdoor commitments have several cryptographic applications. For example, Gennaro proposed a conversion that makes a non-interactive multi-trapdoor commitment scheme into a noninteractive and reusable non-malleable commitment scheme and a compiler that transforms any proof of knowledge into concurrently nonmalleable one. Gennaro gave constructions of multi-trapdoor commitments, but they rely on stronger assumptions, such as the strong RSA assumption, the q-strong Diffie-Hellman assumption. In this paper, we propose a non-interactive multi-trapdoor commitment scheme from the standard RSA assumption. Thus, as a corollary of our result, we obtain a non-interactive and reusable non-malleable commitment scheme from the standard RSA assumption. Our scheme is based on theHohenberger-Waters signature scheme proposed at CRYPTO2009. Several non-interactive and reusable non-malleable commitment schemes (in the common reference string model) have been proposed, but all of them rely on stronger assumptions (e.g., strong RSA).

Honest-Sender Commitment and Honest-Receiver Commitment

摘要: 诚实发送者承诺是为了构造非交互的非延展承诺而引入的。该文给出了两个诚实发送者承诺：第1个是诚实发送者统计绑定的，第2个是完全隐藏的。这两个协议都不是承诺方案。这说明诚实发送者承诺是弱于承诺方案的密码学原语。此外，该文定义了诚实接收者承诺，并给出了两个构造：第1个构造具有统计绑定性质，第2个构造具有诚实接收者完全隐藏性质。这两个方案都不是承诺方案，从而说明了诚实接收者承诺是弱于承诺方案的密码学原语。 关键词: 密码学 / 承诺方案 / 诚实发送者承诺 / 诚实接收者承诺

An Efficient Adaptive-Deniable-Concurrent Non-malleable Commitment Scheme

It is known that composable secure commitments, that is, concurrent non-malleable commitments exist in the plain model, based only on standard assumptions such as the existence of claw-free permutations or even one-way functions. Since being based on the plain model, the deniability of them is trivially satisfied, and especially the latter scheme satisfies also adaptivity, hence it is adaptive-deniable-concurrent non-malleable. However, those schemes cannot be said to be practically efficient. We show a practically efficient (string) adaptive-deniable-concurrent commitment scheme is possible under a global setup model, called the Global CRS-KR model.

Secure Computation Without Authentication

Research on secure multiparty computation has mainly concentrated on the case where the parties can authenticate each other and the communication between them. This work addresses the question of what security can be guaranteed when authentication is not available. We consider a completely unauthenticated setting, where all messages sent by the parties may be tampered with and modified by the adversary without the uncorrupted parties being able to detect this fact. In this model, it is not possible to achieve the same level of security as in the authenticated-channel setting. Nevertheless, we show that meaningful security guarantees can be provided: Essentially, all the adversary can do is to partition the network into disjoint sets, where in each set the computation is secure in of itself, and also independent of the computation in the other sets. In this setting we provide, for the first time, nontrivial security guarantees in a model with no setup assumptions whatsoever. We also obtain similar results while guaranteeing universal composability, in some variants of the common reference string model. Finally, our protocols can be used to provide conceptually simple and unified solutions to a number of problems that were studied separately in the past, including password-based authenticated key exchange and nonmalleable commitments. As an application of our results, we study the question of constructing secure protocols in partially authenticated networks, where some of the links are authenticated, and some are not (as is the case in most networks today).

Efficient Non-malleable Commitment Schemes

Non-malleability protects against man-in-the middle attacks on cryptographic protocols. Non-malleable commitment schemes, for example, assure that a commitment of a message does not help to produce a commitment of a related message. Here we present efficient constructions of such commitment schemes in the common reference string model, based on standard assumptions such as RSA, factoring or discrete logarithm. Our protocols require only three rounds and a few modular exponentiations, and provide statistical or even perfect secrecy of committed values. We also discuss differences between the notion of non-malleable commitment schemes used in previous works by Dolev, Dwork and Naor and by Di Crescenzo, Ishai and Ostrovsky. The former definition requires that it is infeasible to find a commitment such that there exists an encapsulated message which is related to another committed value (non-malleability with respect to commitment). The second approach allows the existence of such messages, but then it is hard to find them and to output them in the opening phase (non-malleability with respect to opening). We note that our solutions are of the second type.

Efficient Non-Malleable Commitment Schemes

We present efficient non-malleable commitment schemes based on standard assumptions such as RSA and Discrete-Log, and under the condition that the network provides publicly available RSA or Discrete-Log parameters generated by a trusted party. Our protocols require only three rounds and a few modular exponentiations. We also discuss the difference between the notion of non-malleable commitment schemes used by Dolev, Dwork and Naor [DDN00] and the one given by Di Crescenzo, Ishai and Ostrovsky [DI098].

Non-interactive and non-malleable commitment scheme based on q-one way group homomorphisms

Commitment scheme is a basic component of many cryptographic protocols, such as coin-tossing, identification schemes, zero-knowledge and multi-party computation. In order to prevent man-in-middle attacks, non-malleability is taken into account. Many forming works focus on designing non-malleable commitments schemes based on number theory assumptions. In this paper we give a general framework to construct non-interactive and non-malleable commitment scheme with respect to opening based on more general assumptions called q-one way group homomorphisms (q-OWGH). Our scheme is more general since many existing commitment schemes can be deduced from our scheme.

New and Improved Constructions of Nonmalleable Cryptographic Protocols

We present a new constant-round protocol for nonmalleable zero-knowledge. Using this protocol as a subroutine, we obtain a new constant-round protocol for nonmalleable commitments. Our constructions rely on the existence of (standard) collision-resistant hash functions. Previous constructions either relied on the existence of trapdoor permutations and hash functions that are collision resistant against subexponential-sized circuits or required a superconstant number of rounds. Additional results are the first construction of a nonmalleable commitment scheme that is statistically hiding (with respect to opening) and the first nonmalleable commitments that satisfy a strict polynomial-time simulation requirement. Our approach differs from the approaches taken in previous works in that we view nonmalleable zero-knowledge as a building block rather than an end goal. This gives rise to a modular construction of nonmalleable commitments and results in a somewhat simpler analysis.

Concurrent Nonmalleable Commitments

We present a nonmalleable commitment scheme that retains its security properties even when concurrently executed a polynomial number of times. That is, a man-in-the-middle adversary who is simultaneously participating in multiple concurrent commitment phases of our scheme, both as a sender and as a receiver, cannot make the values to which he commits depend on the values to which he receives commitments. Our result is achieved without assuming an a priori bound on the number of executions and without relying on any setup assumptions. Our construction relies on the existence of standard claw-free permutations and requires only a constant number of communication rounds.

A Straight-Line Extractable Non-malleable Commitment Scheme

Non-malleability is an important security property of commitment schemes. The property means security against the man-in-the-middle attack, and it is defined and proved in the simulation paradigm using the corresponding simulator. Many known non-malleable commitment schemes have the common drawback that their corresponding simulators do not work in a straight-line manner, requires rewinding of the adversary. Due to this fact, such schemes are proved non-malleable only in the stand-alone cases. In the multiple-instances setting, i.e., when the scheme is performed concurrently with many instances of itself, such schemes cannot be proved non-malleable. The paper shows an efficient commitment scheme proven to be non-malleable even in the multiple-instances setting, based on the KEA1 and DDH assumptions. Our scheme has a simulator that works in a straight-line manner by using the KEA1-extractor instead of the rewinding strategy.

Relationship Between a Non-Malleable Commitment Scheme and a Modified Selective Decommitment Scheme

The notion of commitment is one of the most important primitives in cryptography. To meet various needs, there have been many kinds of commitment schemes among which non-malleable commitment scheme and selective decommitment scheme are important and in general use. And, the increasing security demands suggest a closer look at the relationship between the two schemes. For the convenience of our proof, a new definition for selective decommitment scheme is proposed, which is named as modified selective decommitment scheme. The security relation is deduced that a nonmalleable commitment scheme implies a modified selective decommitment scheme, but the reverse is not true.