An Algebraic Approach to Nonmalleability

In their seminal work on nonmalleable cryptography, Dolev, Dwork, and Naor showed how to construct a nonmalleable commitment with logarithmically-many “rounds''/``slots,” the idea being that any adversary may successfully maul in some slots but would fail in at least one. Since then new ideas have been introduced, ultimately resulting in constant-round protocols based on any one-way function. Yet, in spite of this remarkable progress, each of the known constructions of nonmalleable commitments leaves something to be desired. In this paper we propose a new technique that allows us to construct a nonmalleable protocol with only a single slot and to improve in at least one aspect over each of the previously proposed protocols. Two direct byproducts of our new ideas are a four-round nonmalleable commitment and a four-round nonmalleable zero-knowledge argument, the latter matching the round-complexity of the best known zero-knowledge argument (without the nonmalleability requirement). The protocols are based on the existence of one-way functions and admit very efficient instantiations via standard homomorphic commitments and sigma protocols. Our analysis relies on algebraic reasoning, and makes use of error correcting codes in order to ensure that committers' tags differ in many coordinates. One way of viewing our construction is as a method for combining many atomic subprotocols in a way that simultaneously amplifies soundness and nonmalleability, thus requiring much weaker guarantees to begin with, and resulting in a protocol which is much trimmer in complexity compared to the existing ones.