The results discussed in this section are standard and straightforward (although tedious) to derive. The proofs and theorem statement we present are almost exactly the same as those found in [GKP+18] and [GSZ20, Appendix A] (which in turn are straightforward generalizations
of prior results in [CG15, CGL16, Li17]), but using our notation and specified for our needs.
Definition 53 (Basic Two-Source Non-Malleable Extractor). A functionnmExt: {0,1}N ×
{0,1}N → {0,1}`is said to be abasic (k, ε, τ)-non-malleable extractorif for any two independent
(N, k)-sourcesX andY and arbitrary pairs of tampering functions (fi, gi)i=1,...,τ such that for each ieither fi or gi has no fixed points, we have
∆(nmExt(X, Y);U`|nmExt(f1(X), g1(Y)), . . . ,nmExt(fτ(X), gτ(Y)))≤ε.
Moreover, we say nmExtis strongif we have
∆(nmExt(X, Y);U`|Y,nmExt(f1(X), g1(Y)), . . . ,nmExt(fτ(X), gτ(Y)))≤ε.
We show that every basic non-malleable extractor is also a strong non-malleable extractor according to Definition 16 with only a slight loss in the parameters. Since [CGL16, Li17] construct basic non-malleable extractors, the desired results follow easily. We begin by proving that every basic non-malleable extractor is also a strong basic non-malleable extractor with slightly worse parameters.
Lemma 54. If nmExtis a basic (k, ε, τ)-non-malleable extractor, then, for any k0 ≥k, it is
also a strong basic(k0, ε0, τ)-non-malleable extractor forε0= 2`(τ+1)(ε+ 2k+1−k0).
Proof. This proof is a straightforward extension of [Li17, Theorem 8.1] to the case of multiple tamperings, which, in turn, is based on a result originally due to Barak [Rao07, Theorem 5.1],
and also appears in [GSZ20]. Fix arbitrary independent (N, k0)-sourcesX andY and tampering functions (fi, gi)i=1,...,τ such that for eachieither fi orgi has no fixed points. LetXi=fi(X)
andYi=gi(Y) fori= 1, . . . , τ andX0=X,Y0=Y.
For each z= (z0, z1, . . . , zτ)∈ {0,1}`(τ+1), define the sets
Bz+={y: Pr[∀i≥0 :nmExt(Xi, yi) =zi]−2−`Pr[∀i≥1 :nmExt(Xi, yi) =zi]> ε}
and
Bz−={y: 2−`Pr[∀i≥1 :nmExt(Xi, yi) =zi]−Pr[∀i≥0 :nmExt(Xi, yi) =zi]> ε},
and letBz =Bz+∪Bz−. We claim that|Bz|<2k+1 for everyz. Indeed, if this is not the case,
then either |B+
z| ≥2k or |Bz−| ≥2k. Without loss of generality, we may assume the former.
In that case, consider the (N, k)-source Y0 uniformly distributed over B+
z. Then, it follows
immediately from the definition ofB+ z that
∆(nmExt(X, Y0);U`|nmExt(f1(X), g1(Y0)), . . . ,nmExt(fτ(X), gτ(Y0)))> ε,
which contradicts the fact thatnmExtis a basic (k, ε, τ)-non-malleable extractor. As a result, we also conclude thatB:=S
z∈{0,1}`(τ+1)Bz satisfies|B|<2`(τ+1)2k+1.
LettingYB denote (Y|Y 6∈B), define
∆B = ∆(nmExt(X, YB);U`|YB,nmExt(f1(X), g1(YB)), . . . ,nmExt(fτ(X), gτ(YB))).
From the definition ofB, it follows that
∆B≤X
y6∈B
Pr[YB =y]·2`(τ+1)·ε= 2`(τ+1)·ε.
Then, a straightforward application of the triangle inequality implies that
∆(nmExt(X, Y);U`|Y,nmExt(f1(X), g1(Y)), . . . ,nmExt(fτ(X), gτ(Y))) ≤Pr[Y ∈B] + Pr[Y 6∈B]·∆B
≤2`(τ+1)·2k+1−k0+ ∆B
≤2`(τ+1)(ε+·2k+1−k0),
where the second inequality follows from the fact that|B| ≤2`(τ+1)·2k+1as seen above and that
Y is an (N, k0)-source, and the third inequality holds because ∆
B ≤2
`(τ+1)·ε. This concludes
the proof.
Lemma 55. If nmExtis a strong basic(k, t, ε)-non-malleable extractor, then, for anyk0 ≥k and δ > 0, it is also a strong (k0 + log(1/δ), ε0+δ, τ)-non-malleable extractor (according to Definition 16) forε0= 22τ(ε+ 2k−k0).
Proof. Analogous proofs of this result can be found in [CGL16, GKP+18, GSZ20], but the
implication explicitly stated in those works is weaker than the one we present here. Fix arbitrary tampering functions (fi, gi)i=1,...,τ. We show that
∆(nmExt(X, Y);U`|Y,Df1,g1(X, Y), . . . ,Dfτ,gτ(X, Y))≤ε
0 (16)
for arbitrary independent (N, k0)-sources X and Y. The proof is completed by recalling the well-know argument that, if nmExt satisfies (16) for arbitrary (N, k0)-sources, then it also satisfies
∆(nmExt(X, Y);U`|W, Y,Df1,g1(X, Y), . . . ,Dfτ,gτ(X, Y))≤ε
for anyδ > 0 and arbitrary sources X, W, and Y such that (X, W) is independent ofY and
H∞(X|W),H∞(Y) ≥ k0 + log(1/δ). This is a direct consequence of a result from [MW97] stating that, in this case, we have
Pr
w∼W[H∞(X|W =w)≥k
0]≥1−δ.
To conclude the proof, it remains to prove (16) for independent (N, k0)-sources X and Y. Given setsR, S ⊆[τ], define
W(R)={x∈ {0,1}N :∀i∈R:fi(x) =x,∀i6∈R:fi(x)6=x}
and
V(S)={y∈ {0,1}N :∀i∈S:g
i(y) =y,∀i6∈S:gi(y)6=y}.
Note that both families of sets partition{0,1}N. LetX(R)denoteX conditioned onX∈W(R),
and likewise forY(S) andY. Define
αR,S= Pr[X ∈W(R)]·Pr[Y ∈V(S)] and ∆R,S= ∆(nmExt(X(R), Y(S));U`|Y(S),Df1,g1(X (R), Y(S)), . . . ,D ft,gt(X (R), Y(S))).
Then, by the triangle inequality, it holds that (16) is upper bounded by
X
R,S⊆[τ]
αR,S·∆R,S.
We show thatαR,S·∆R,S≤ε+ 2k−k
0
for allR andS, which implies the desired upper bound on (16). We proceed by cases:
• H∞(X(R))< k or H∞(Y(S))< k: Consider the former (the argument is analogous for the latter). Then, there is x ∈W(R) such that Pr[X(R) =x] >2−k. This implies that
Pr[X ∈W(R)]<2k·Pr[X =x]≤2k−k0, sinceXis an (N, k0)-source. Hence,αR,S≤2k−k0.
• H∞(X(R)),H∞(Y(S))≥k: Then,X(R)and Y(S) are independent (N, k)-sources. More- over, fori∈R∩Swe haveDfi,gi(X
(R), Y(S)) =same∗∗with probability 1, and fori6∈R∩S we have that either fi has no fixed points over the support of X(R), or gi has no fixed
points over the support ofY(S), and thatDfi,gi(X
(R), Y(S)) =nmExt(fi(X(R)), gi(Y(S))).
Therefore, the fact thatnmExtis a strong basic (k0, ε0, τ)-non-malleable extractor imme- diately implies that ∆R,S≤ε0 in this case.
Combining Lemmas 54 and 55 leads to the following theorem.
Theorem 56. Every basic(k, ε, τ)-non-malleable extractornmExt:{0,1}N×{0,1}N → {0,1}` is also a strong(k0+ log(1/δ), ε0+δ, τ)-non-malleable extractor (according to Definition 16) for any k0≥k andδ >0with
ε0= 2`(τ+1)+2τ(ε+ 2k+2−k0).
Combining Theorem 56 with the basic non-malleable extractors from [CGL16, Li17] and setting, say,δ=εimmediately yields the following explicit strong non-malleable extractors.
Corollary 57(based on [Li17, Definition 1.5 and Theorems 7.9 and 7.11]). For some constant γ >0, there exists an explicit strong(k, ε,1)-non-malleable extractor (according to Definition 16) nmExt:{0,1}N×{0,1}N → {0,1}`withk= (1−γ)N,ε= 2−Ω(N/logN), and`= Ω(N/logN).
We note that a version of the basic non-malleable extractor from [Li17] with improved error 2−Ω(Nlog loglogNN)was obtained in [Li19]. This means that our non-malleable secret sharing scheme
against a single tampering can now be instantiated with slightly improved parameters compared to Corollary 39.
Corollary 58 (based on [CGL16, Lemma 6.13 and Theorem 8.7]). For some constant γ >
0, there exists an explicit strong (k, ε, τ)-non-malleable extractor (according to Definition 16) nmExt:{0,1}N× {0,1}N → {0,1}` withk=N−Nγ,ε= 2−NΩ(1)
,τ =NΩ(1), and`=NΩ(1).