Lectures 3-4 - Non-Malleable Protocols

We consider the execution of two-party protocols in the presence of an adversary that has full control of the communication channel between the parties. The adversary has the power to omit, insert or modify messages at its choice. It has also full control over the scheduling of the messages. The honest parties are not necessarily aware to the existence of the adversary, and are not allowed to use any kind of trusted set-up (such as a common reference string). The above kind of attack is often referred to as a man-in-the-middle attack. It models a natural scenario whose investigation is well motivated. Protocols that retain their security properties in face of a man-in-the-middle are said to be non-malleable. The rigorous treatment of two-party protocols in the man-in-the-middle setting has been initiated in the seminal paper by Dolev, Dwork and Naor [4]. The paper contains definitions of security for the tasks of non-malleable commitment and non-malleable zero-knowledge. It also presents protocols that meet these definitions. The protocols rely on the existence of one-way functions, and require O(log n) rounds of interaction, where n ∈ N is a security parameter. A more recent result by Barak presents constant-round protocols for non-malleable commitment and non-malleable zero-knowledge [2]. This is achieved by constructing a coin-tossing protocol that is secure against a man in the middle, and then using the outcome of this protocol to instantiate known constructions for non-malleable commitment and zero-knowledge in the common reference string model. The proof of security makes use of non black-box techniques and is highly complex. It relies on the existence of trapdoor permutations and hash functions that are collision-resistant against sub-exponential sized circuits. In this lecture we present a construction of new constant-round protocols for non-malleable commitment and non-malleable zero-knowledge by Pass and Rosen [7]. Similarly to the above works, we will refrain from relying on any kind of set-up assumption.