Nonmalleable extractors with short seeds and applications to privacy amplification

Motivated by the classical problem of privacy amplification, Dodis and Wichs [in Proceedings of the 41St Annual ACM Symposium on Theory of Computing, 2009, pp. 601-610] introduced the notion of a nonmalleable extractor, significantly Strengthening the notion of a Strong extractor. A nonmalleable extractor is a function nmExt : {0, 1}ⁿ ×{0, 1}^d γ {0, 1}^m that takes two inputs-a weak source W and a uniform (independent) seed S-and outputs a String nmExt(W, S) that is neCPly uniform given the seed S as well as the value nmExt(W, S) for any seed S≠ S that may be determined as an CPbitrCPy function of S. The firSt explicit conStruction of a nonmalleable extractor was recently provided by Dodis et al. [Privacy Amplification and Non-malleable Extractors via ChCPacter Sums, preprint, CPXiv:1102.5415 [cs.CR], 2011]. Their extractor works for any weak source with min-entropy rate 1/2+δ, where δ > 0 is an CPbitrCPy conStant and outputs up to a lineCP number of bits but suffers from two drawbacks. FirSt, the length of its seed is lineCP in the length of the weak source (which leads to privacy amplification protocols with high communication complexity). Second, the conStruction is conditional: when outputting more than a logCPithmic number of bits (as required for privacy amplification protocols), its efficiency relies on a longStanding conjecture on the diStribution of prime numbers. In this paper we present an unconditional conStruction of a nonmalleable extractor with short seeds. For any integers n and d such that 2.01 . log n ≤ d ≤ n, we present an explicit conStruction of a nonmalleable extractor nmExt : {0, 1}n×{0, 1}d γ {0, 1}m, with m = Ω(d) and error exponentially small in m. The extractor works for any weak source with minentropy rate 1/2 + δ, where δ > 0 is an CPbitrCPy conStant. Moreover, our extractor in fact satisfies an even more general notion of nonmalleability: its output nmExt(W, S) is neCPly uniform given the seed S as well as the values nmExt(W, St), ⋯ , nmExt(W, S_t) for several seeds St, ⋯ ,St that may be determined as an CPbitrCPy function of S, as long as S /∉ {St, ⋯ ,St}. By inStantiating the framework of Dodis and Wichs with our nonmalleable extractor, we obtain the firSt 2-round privacy amplification protocol for min-entropy rate 1/2 + δ with asymptotically optimal entropy loss and polylogCPithmic communication complexity. This improves the previously known 2-round privacy amplification protocols: the protocol of Dodis and Wichs, whose entropy loss is not asymptotically optimal, and the protocol of Dodis et al., whose communication complexity is lineCP.