Expander Graphs are Non-Malleable Codes

Abstract

Any $d$-regular graph on $n$ vertices with spectral expansion $\lambda$ satisfying $n=\Omega(d^{3}\log(d)/\lambda)$ yields a $O\left(\frac{\lambda^{3/2}}{d}\right)$-non-malleable code for single-bit messages in the split-state model.

1 Introduction

A split-state non-malleable code [DPW10] for single-bit messages consists of randomized encoding and decoding algorithms $(\enc,\dec)$. A message $m\in\{0,1\}$ is encoded as a pair of strings $(L,R)\in\{0,1\}^{k}\times\{0,1\}^{k}$, such that $\dec(L,R)=m$. An adversary then specifies an arbitrary pair of functions $g,h:\{0,1\}^{k}\rightarrow\{0,1\}^{k}$. The code is said to be non-malleable if, intuitively, the message obtained as $\dec(g(L),h(R))$ is “unrelated” to the original message $m$. In particular, to be $\varepsilon$-non-malleable, it is enough [DKO13] to guarantee that when the message $m$ is chosen uniformly at random and encoded into $(L,R)$, the probability that $\dec(g(L),h(R))=1-m$ is at most $\frac{1}{2}+\varepsilon$. Since their introduction in 2010 [DPW10], split-state non-malleable codes have been the subject of intense study within theoretical computer science [DPW10, DKO13, ADL14, CZ14, CGL16, Li17].

In this work, we show that expander graphs immediately give rise to split-state non-malleable codes for single-bit messages. Specifically, we show that any $d$-regular graph on $n=2^{k}$ nodes with spectral expansion $\lambda$ satisfying $n=\Omega(d^{3}\log(d)/\lambda)$ yields a $O\left(\frac{\lambda^{3/2}}{d}\right)$-non-malleable code for single-bit messages in the split-state model. Our proof is elementary, requiring a little more than two (fullsize) pages to prove, having at its heart two nested applications of the Expander Mixing Lemma. Furthermore, we only need expanders of high degree (e.g., $d=n^{\varepsilon}$), which can be constructed and analyzed easily (see, e.g., [Tre] or the appendix), yielding $2^{-\Omega(k)}$-non-malleable codes.

Comparison with Previous Work.

Until our work, all known proofs of security for explicit split-state non-malleable codes have required complex mathematical proofs, and all known such proofs either directly or indirectly used the mathematics behind constructions of two-source extractors [DKO13, ADL14, CZ14, CGL16, Li17]. In fact, after constructing the first non-malleable code in the split-state model Dziembowski, Kazana, and Obremski wrote: “This brings a natural question if we could show some relationship between the extractors and the non-malleable codes in the split-state model. Unfortunately, there is no obvious way of formalizing the conjecture that non-malleable codes need to be based on extractors” [DKO13]. We thus simultaneously find the first simple, elementary solution to the problem of designing single-bit non-malleable codes (our proof being approximately one-third the length of the proof of security of the single-bit non-malleable code of [DKO13]) and answer in the negative the implicit conjecture of [DKO13]; it is not necessary to base constructions of non-malleable codes on the theory of extractors.

Our construction of non-malleable codes from expander graphs thus opens up a new line of attack in the study of split-state non-malleable codes. It is important to keep in mind that current constructions of non-malleable codes supporting messages of arbitrary length use many ideas pioneered in the construction of [DKO13], in particular the use of extractors. While we do not yet know how to generalize our results beyond single-bit messages, we speculate that further investigation building upon our work will reveal a deeper connection and more powerful simple constructions based on expanders.

It should be noted that two-source extractors are well-known to exhibit expansion properties; however, in all previous proofs, much more than mere expansion was used to argue non-malleability. Indeed previous proofs apply extractors repeatedly; for instance the proof of [DKO13] uses the extractor property several times (e.g., in equation (22) and using equation (43) in [DKO13]). Previous proofs also highlight the nontriviality and care that is required in applying extractors correctly to yield a valid proof of non-malleability (e.g., the paragraph beginning with “There are two problems with the above argument.” found below equation (36) of [DKO13]). With respect to the expansion properties of two-source extractors, it is not surprising that 1-bit non-malleable codes will have some sort of expansion properties. Our contribution is the converse: that good expansion is sufficient for the construction of non-malleable codes.

2 Preliminaries

We shall assume familiarity with the basics of codes and non-malleable codes. A cursory review of relevant definitions can be found in the appendix.

Notation 1 (Graphs).

A graph $G=(V,E)$ consists of vertices $V$ and edges $E\subset V\times V$. In this exposition every graph is undirected and $n=\left|V\right|$ always denotes the number of vertices of the graph in question.

• For any $v\in V$ we denote by $N(v)$ the set of neighbors of $v$ in $G$.

• For any two subsets $S,T\subseteq V$ we denote by $E(S,T)$ the set of (directed) edges from $S$ to $T$ in $G$. I.e. $E(S,T)=\{(v,u)\in S\times T\mid(v,u)\in E\}$.

Definition 1 (Spectral Expander).

Let $G=(V,E)$ be a $d$-regular graph, $A_{G}$ be its adjacency matrix, and $\lambda_{1}\geq\dots\geq\lambda_{n}$ be the eigenvalues of $A_{G}$. We say that $G$ is a $\lambda$ spectral expander if $\lambda\geq\max\{\left|\lambda_{2}\right|,\dots,\left|\lambda_{n}\right|\}$.

Theorem 2 (Expander Mixing Lemma).

Suppose that $G=(V,E)$ is a $\lambda$ spectral expander. Then for every pair of subsets $S,T\subset V$ we have

$$\left|\left|E(S,T)\right|-\frac{d\cdot\left|S\right|\cdot\left|T\right|}{n}\right|\leq\lambda\sqrt{\left|S\right|\cdot\left|T\right|}.$$

Our results will rely on the following characterization of 1-bit non-malleable codes by Dziembowski, Kazana, and Obremski found in [DKO13].

Theorem 3.

Let $(\enc,\dec)$ be a coding scheme with $\enc\colon\{0,1\}\to\mathcal{X}$ and $\dec\colon\mathcal{X}\to\{0,1\}$. Further, let $\mathcal{F}$ be a set of functions $f\colon\mathcal{X}\to\mathcal{X}$. Then $(\enc,\dec)$ is $\varepsilon$-non-malleable with respect to $\mathcal{F}$ if and only if for every $f\in\mathcal{F}$,

$$\Pr_{b\xleftarrow{u}\{0,1\}}(\dec(f(\enc(b)))=1-b)\leq\frac{1}{2}+\varepsilon,$$

where the probability is over the uniform choice of $b$ and the randomness of $\enc$.

3 Results

We first formally introduce our candidate code and then prove that it is a non-malleable code.

3.1 Candidate Code

From a graph we can very naturally construct a coding scheme as follows.

Definition 4 (Graph Code).

Let $G=(V,E)$ be a graph. The associated graph code, $(\enc_{G},\dec_{G})$, consists of the functions

$$\enc_{G} \colon\{0,1\}\to V\times V, \dec_{G} \colon V\times V\to\{0,1\}$$

which are randomized and deterministic, respectively, and given by

$$\enc_{G}(b) =\begin{cases}(u,v)\xleftarrow{u}(V\times V)\setminus E,&b=0,\\ (u,v)\xleftarrow{u}E,&b=1,\end{cases}$$

$$\dec_{G}(v_{1},v_{2}) =\begin{cases}0,&(v_{1},v_{2})\not\in E,\\ 1,&(v_{1},v_{2})\in E.\end{cases}$$

3.2 Non-Malleability of Expander Graph Codes

Finally, arriving at the core of the matter, we first establish the following lemma casting the expression of Theorem 3 in terms of graph properties.

Proposition 5.

Let $G=(V,E)$ be a graph, functions $g,h\colon V\to V$ be given, and $f=(g,h)\colon V\times V\to V\times V$ satisfy $f(u,v)=(g(u),h(v))$. For the probability that $f$ flips a random bit encoded by $\enc_{G}$, write

$$T=\Pr_{b\xleftarrow{u}\{0,1\}}(\dec_{G}(f(\enc_{G}(b)))=1-b)$$

where the probability is taken over the randomness of $\enc_{G}$ and the sampling of $b$. Then

$$T =\frac{1}{2}+\frac{1}{2d(n-d)}\sum_{(v,u)\in E}\left(\frac{d\left|g^{-1}(v)\right|\cdot\left|h^{-1}(u)\right|}{n}-\left|E(g^{-1}(v),h^{-1}(u))\right|\right).$$

Proof.

For $b\in\{0,1\}$ denote by $Q_{b}$ the probability

$$Q_{b}=\Pr(\dec_{G}(f(\enc_{G}(b)))=1-b)$$

taken over the randomness of $\enc_{G}$. It is clear that $T=\frac{Q_{0}+Q_{1}}{2}$ and that by definition

$$Q_{0} =\Pr_{(v,u)\xleftarrow{u}V\times V\setminus E}\left[(g(v),h(u))\in E\right], Q_{1} =\Pr_{(v,u)\xleftarrow{u}E}\left[(g(v),h(u))\not\in E\right].$$

First, for $b=0$ we see that the number of non-edges that are mapped by $f$ to any given $(v,u)\in E$ is given by $\left|g^{-1}(v)\right|\cdot\left|h^{-1}(u)\right|-\left|E(g^{-1}(v),h^{-1}(u))\right|$. There are $n(n-d)$ non-edges in $G$ so it follows that

$$Q_{0}=\frac{\sum_{(v,u)\in E}\left|g^{-1}(v)\right|\cdot\left|h^{-1}(u)\right|-\left|E(g^{-1}(v),h^{-1}(u))\right|}{n(n-d)}.$$

Second, for $b=1$ the number of edges of $G$ that are mapped to non-edges by $f$ is given by $\sum_{(v,u)\not\in E}\left|E(g^{-1}(v),h^{-1}(u))\right|$. Since there are $dn$ edges of $G$ to choose from when encoding the bit $b=1$,

$$Q_{1}=\frac{\sum_{(v,u)\not\in E}\left|E(g^{-1}(v),h^{-1}(u))\right|}{dn}.$$

Now, observing that the number of (directed) edges in the graph is $dn$ and that $\{g^{-1}(v)\}_{v\in V}$ and $\{h^{-1}(u)\}_{u\in V}$ are both partitions of $V$, we get

$$Q_{1} =\frac{dn-\sum_{(v,u)\in E}\left|E(g^{-1}(v),h^{-1}(u))\right|}{dn}=1-\frac{\sum_{(v,u)\in E}\left|E(g^{-1}(v),h^{-1}(u))\right|}{dn}.$$

Putting it all together,

$$T = \frac{\sum_{(v,u)\in E}\left|g^{-1}(v)\right|\cdot\left|h^{-1}(u)\right|-\left|E(g^{-1}(v),h^{-1}(u))\right|}{2n(n-d)}+\frac{1}{2}-\frac{\sum_{(v,u)\in E}\left|E(g^{-1}(v),h^{-1}(u))\right|}{2dn}$$

$$= \frac{1}{2}+\frac{1}{2d(n-d)}\sum_{(v,u)\in E}\left(\frac{d\left|g^{-1}(v)\right|\cdot\left|h^{-1}(u)\right|}{n}-\left|E(g^{-1}(v),h^{-1}(u))\right|\right).$$

∎

We proceed immediately with the main theorem, which concludes the exposition. In order to keep this presentation short and to the point, more elaborate calculations, which save a few $\log$-factors, have been placed in the appendix as Theorem 9.

Theorem 6.

Let $G=(V,E)$ be $d$-regular with spectral expansion $\lambda$ satisfying $n=\Omega(d^{3}\log(d)^{4}/\lambda)$. Then $(\enc_{G},\dec_{G})$ is an $\tilde{O}\left(\frac{\lambda^{3/2}}{d}\right)$-non-malleable code in the split-state model.

Proof.

Let $f=(g,h)\colon V\times V\to V\times V$ be given. By Theorem 3 and Proposition 5 we just need to show that

$$R=\frac{1}{2d(n-d)}\cdot\sum_{(v,u)\in E}\left(\frac{d\left|g^{-1}(v)\right|\cdot\left|h^{-1}(u)\right|}{n}-\left|E(g^{-1}(v),h^{-1}(u))\right|\right)$$

is bounded by $\tilde{O}\left(\frac{\lambda^{3/2}}{d}\right)$. Define the sets

$$G_{1} =\left\{v\in V\mid\left|g^{-1}(v)\right|>\frac{n}{d^{2}}\right\}, H_{1} =\left\{u\in V\mid\left|h^{-1}(u)\right|>\frac{n}{d^{2}}\right\},$$

$$G_{2} =\left\{v\in V\mid\left|g^{-1}(v)\right|\leq\frac{n}{d^{2}}\right\}, H_{2} =\left\{u\in V\mid\left|h^{-1}(u)\right|\leq\frac{n}{d^{2}}\right\},$$

for $i,j\in\{1,2\}$ write

$$R_{i,j}=\frac{1}{2d(n-d)}\sum_{(v,u)\in E\cap(G_{i}\times H_{j})}\left(\frac{d\left|g^{-1}(v)\right|\cdot\left|h^{-1}(u)\right|}{n}-\left|E(g^{-1}(v),h^{-1}(u))\right|\right),$$

and observe that $R=\sum_{1\leq i,j\leq 2}R_{i,j}$.

Consider the case when $i=2$. Simply bounding the terms of the form $\left|g^{-1}(v)\right|\cdot\left|h^{-1}(u)\right|$ by using that each vertex has only $d$ neighbours, we get

$$R_{2,1}+R_{2,2} \leq\frac{1}{2n(n-d)}\sum_{(v,u)\in E\cap(G_{2}\times V)}\left|g^{-1}(v)\right|\cdot\left|h^{-1}(u)\right|$$

$$\leq\frac{1}{2n(n-d)}\cdot d\cdot\sum_{u\in V}\frac{n}{d^{2}}\cdot\left|h^{-1}(u)\right|=\frac{n}{2(n-d)d}.$$

Thus, $R_{2,1}+R_{2,2}=O\left(d^{-1}\right)$. By symmetry, $R_{1,2}=O\left(d^{-1}\right)$. It only remains to show that $R_{1,1}=\tilde{O}\left(\frac{\lambda^{3/2}}{d}\right)$. To this end, partition $G_{1}$ and $H_{1}$, respectively, as

$$G_{1}^{k} =\left\{v\in G_{1}\mid\frac{n}{2^{k-1}}\geq\left|g^{-1}(v)\right|>\frac{n}{2^{k}}\right\}, H_{1}^{l} =\left\{v\in H_{1}\mid\frac{n}{2^{l-1}}\geq\left|h^{-1}(u)\right|>\frac{n}{2^{l}}\right\}$$

for $1\leq k,l\leq\left\lceil\log_{2}\left(d^{2}\right)\right\rceil$. Now, focusing on each pair $G_{1}^{k}$ and $H_{1}^{l}$, we write

$$S_{k,l}=\frac{1}{2d(n-d)}\sum_{(v,u)\in E\cap(G_{1}^{k}\times H_{1}^{l})}\left(\frac{d\left|g^{-1}(v)\right|\cdot\left|h^{-1}(u)\right|}{n}-\left|E(g^{-1}(v),h^{-1}(u))\right|\right)$$

and apply first the mixing lemma then the Cauchy-Schwartz inequality to get

$$2d(n-d)S_{k,l} = \sum_{v\in G_{1}^{k}}\left(\frac{d\left|g^{-1}(v)\right|\cdot\sum_{u\in N(v)\cap H_{1}^{l}}\left|h^{-1}(u)\right|}{n}-\left|E\left(g^{-1}(v),\bigcup_{u\in N(v)\cap H_{1}^{l}}h^{-1}(u)\right)\right|\right)$$

$$\leq \sum_{v\in G_{1}^{k}}\lambda\sqrt{\left|g^{-1}(v)\right|\cdot\sum_{u\in N(v)\cap H_{1}^{l}}\left|h^{-1}(u)\right|}$$

$$\leq \lambda\sqrt{\frac{n}{2^{k-1}}\cdot\frac{n}{2^{l-1}}}\cdot\sum_{v\in G_{1}^{k}}\sqrt{\left|N(v)\cap H_{1}^{l}\right|}$$

$$\leq 2\lambda n\cdot 2^{-\frac{l+k}{2}}\cdot\sqrt{\left|G_{1}^{k}\right|}\cdot\sqrt{\left|E(G_{1}^{k},H_{1}^{l})\right|}.$$

We use the fact that $\left|G_{1}^{k}\right|\leq 2^{k},\left|H_{1}^{l}\right|\leq 2^{l}$, apply the mixing lemma to the last factor, and wield Jensen’s inequality on the arising square root to obtain

$$d(n-d)S_{k,l} \leq\lambda n\cdot 2^{-\frac{l+k}{2}}\cdot\sqrt{\left|G_{1}^{k}\right|}\cdot\sqrt{\frac{d\cdot\left|G_{1}^{k}\right|\cdot\left|H_{1}^{l}\right|}{n}+\lambda\sqrt{\left|G_{1}^{k}\right|\cdot\left|H_{1}^{l}\right|}}$$

$$\leq\lambda\sqrt{2^{k}dn}+2^{\frac{k-l}{4}}\lambda^{3/2}n\leq\lambda\cdot\sqrt{d^{3}n}+2^{\frac{k-l}{4}}\lambda^{3/2}n.$$

By symmetry of $k$ and $l$, $d(n-d)S_{k,l}\leq\lambda\cdot\sqrt{d^{3}n}+2^{\frac{l-k}{4}}\lambda^{3/2}n$. Thus,

$$R_{1,1} =\sum_{1\leq k,l\leq\left\lceil\log_{2}(d^{2})\right\rceil}S_{k,l}$$

$$\leq O\left(\frac{\lambda\log(d)^{2}\cdot\sqrt{d}}{\sqrt{n}}\right)+O\left(\frac{\lambda^{3/2}}{d}\right)\cdot\sum_{1\leq k,l\leq\left\lceil\log_{2}(d^{2})\right\rceil}2^{-\frac{\left|k-l\right|}{4}}$$

$$=O\left(\frac{\log(d)\lambda^{3/2}}{d}\right).$$

∎

Appendix A Definitions for Split-State Non-Malleable Codes

Here, we recall the basic definition of a split-state non-malleable code due to [DPW10].

Definition 7 (Coding scheme).

We define a coding scheme to be a pair of functions $(\enc,\dec)$. The encoding function $\enc\colon\mathcal{M}\to\mathcal{X}$ is randomized while the decoding function $\dec\colon\mathcal{X}\to\mathcal{M}\cup\{\bot\}$ is deterministic. Further, for all $s\in\mathcal{M}$ the pair satisfies

$$\Pr[\dec(\enc(s))=s]=1$$

where the probability is taken over the randomness of $\enc$.

Definition 8 (Split State Non-Malleable Code).

A coding scheme $(enc,\dec)$, $\enc\colon\mathcal{M}\to\mathcal{L}\times\mathcal{R}$ and $\dec\colon\mathcal{L}\times\mathcal{R}\to\mathcal{M}\cup\{\bot\}$, is $\varepsilon$-non-malleable in the split state model if for every pair of functions $g\colon\mathcal{L}\to\mathcal{L},h\colon\mathcal{R}\to\mathcal{R}$ and writing $f=(g,h)$ there exists a distribution $D_{f}$ supported on $\mathcal{M}\cup\{*,\bot\}$ such that for every $s\in\mathcal{M}$ the two random variables defined by the experiments

$$A_{f}^{s} =\left\{\begin{subarray}{c}(L,R)\leftarrow\enc(s);\\ \text{Output }\dec(g(L),h(R))\end{subarray}\right\}$$

$$B_{f}^{s} =\left\{\begin{subarray}{c}\tilde{s}\leftarrow D_{f};\\ \text{If }\tilde{s}=*\text{ output }s\text{ else output }\tilde{s}\end{subarray}\right\}$$

have statistical distance at most $\varepsilon$.

Appendix B Deliver Us from Log Factors

A more thorough analysis of the sums in the proof of Theorem 6 allows us to get slightly better bounds. The technicalities are of little interest to the big picture and were hence omitted in the body of the paper. The addition consists of an alternative ending to the proof of Theorem 6.

Theorem 9.

Let $G=(V,E)$ be $d$-regular with spectral expansion $\lambda$ satisfying $n=\Omega(d^{3}\log(d)/\lambda)$. Then $(\enc_{G},\dec_{G})$ is an $O\left(\frac{\lambda^{3/2}}{d}\right)$-non-malleable code in the split-state model.

Proof.

At the very end of the proof of Theorem 6, we arrived at

$$d(n-d)S_{k,l}\leq 2^{-\frac{l+k}{2}}\lambda n\cdot\sqrt{\left|G_{1}^{k}\right|}\cdot\sqrt{\frac{d\cdot\left|G_{1}^{k}\right|\cdot\left|H_{1}^{l}\right|}{n}+\lambda\cdot\sqrt{\left|G_{1}^{k}\right|\cdot\left|H_{1}^{l}\right|}}.$$

Applying Jensen’s inequality, we get

$$S_{k,l} \leq O\left(\frac{\lambda}{\sqrt{dn}}\right)\cdot 2^{-\frac{l+k}{2}}\cdot\left|G_{1}^{k}\right|\cdot\sqrt{\left|H_{1}^{l}\right|}+O\left(\frac{\lambda^{3/2}}{d}\right)\cdot 2^{-\frac{l+k}{2}}\cdot\sqrt[4]{\left|G_{1}^{k}\right|^{3}\cdot\left|H_{1}^{l}\right|}$$ (1)

with the functions hidden by the $O$-notation being independent of $k,l$.

Now, note that

$$\left|g^{-1}(G_{1}^{k})\right| \geq\frac{n\cdot\left|G_{1}^{k}\right|}{2^{k}} \left|h^{-1}(H_{1}^{l})\right| \geq\frac{n\cdot\left|H_{1}^{l}\right|}{2^{l}}$$ (2)

and for all $k\leq\left\lceil\log_{2}(d^{2})\right\rceil$ we have $\frac{\left|G_{1}^{k}\right|}{2^{k/2}}\leq 2d$. We shall bound each of the terms of (1) separately.

First, write

$$L=\sum_{1\leq k,l\leq\left\lceil\log_{2}(d^{2})\right\rceil}\left(2^{-\frac{l+k}{2}}\cdot\left|G_{1}^{k}\right|\cdot\sqrt{\left|H_{1}^{l}\right|}\right).$$

Using the Cauchy-Schwartz inequality in the second inequality,

$$L \leq 2d\cdot\sum_{1\leq l\leq\left\lceil\log_{2}(d^{2})\right\rceil}\sqrt{2^{-l}\left|H_{1}^{l}\right|}$$

$$\leq O\left(d\cdot\sqrt{\log(d)}\right)\cdot\sqrt{\sum_{1\leq l\leq\left\lceil\log_{2}(d^{2})\right\rceil}2^{-l}\cdot\left|H_{1}^{l}\right|}$$

$$\leq O\left(d\cdot\sqrt{\log(d)}\right)\cdot\sqrt{\sum_{1\leq l\leq\left\lceil\log_{2}(d^{2})\right\rceil}\frac{\left|h^{-1}(H_{1}^{l})\right|}{n}}$$

$$=O\left(d\cdot\sqrt{\log(d)}\right)$$

since the $H_{1}^{l}$ are disjoint subsets of $V$. In conclusion,

$$O\left(\frac{\lambda}{\sqrt{dn}}\right)\cdot\sum_{1\leq k,l\leq\left\lceil\log_{2}(d^{2})\right\rceil}2^{-\frac{l+k}{2}}\cdot\left|G_{1}^{k}\right|\cdot\sqrt{\left|H_{1}^{l}\right|} =O\left(\frac{\lambda\cdot\sqrt{d\cdot log(d)}}{\sqrt{n}}\right)$$

$$=O\left(\frac{\lambda^{3/2}}{d}\right).$$

Second, let $k\leq l$ and write $t=l-k$. We now bound the sum using (2). Write

$$K=\sum_{1\leq k<l\leq\left\lceil\log_{2}(d^{2})\right\rceil}2^{-\frac{l+k}{2}}\cdot\sqrt[4]{\left|G_{1}^{k}\right|^{3}\cdot\left|H_{1}^{l}\right|}.$$

Then

$$K \leq\sum_{1\leq k<l\leq\left\lceil\log_{2}(d^{2})\right\rceil}\left(\frac{2^{\frac{k-l}{4}}}{n}\cdot\sqrt[4]{\left|g^{-1}(G_{1}^{k})\right|^{3}\cdot\left|h^{-1}(H_{1}^{l})\right|}\right)$$

$$\leq\sum_{t=0}^{\left\lceil\log_{2}(d^{2})\right\rceil}\left(\frac{2^{-\frac{t}{4}}}{n}\sum_{l=t}^{\left\lceil\log_{2}(d^{2})\right\rceil}\sqrt[4]{\left|g^{-1}(G_{1}^{l-t})\right|^{3}\cdot\left|h^{-1}(H_{1}^{l})\right|}\right)$$

$$\leq\sum_{t=0}^{\left\lceil\log_{2}(d^{2})\right\rceil}\left(\frac{2^{-\frac{t}{4}}}{n}\left(\sum_{l=t}^{\left\lceil\log_{2}(d^{2})\right\rceil}\left|g^{-1}(G_{1}^{l-t})\right|\right)^{3/4}\cdot\left(\sum_{l=t}^{\left\lceil\log_{2}(d^{2})\right\rceil}\left|h^{-1}(H_{1}^{l})\right|\right)^{1/4}\right)$$

$$\leq\sum_{t=0}^{\left\lceil\log_{2}(d^{2})\right\rceil}2^{-\frac{t}{4}}=O(1),$$

where the third inequality is established using Hölder’s inequalty.

It now follows that

$$\sum_{1\leq k\leq l\leq\left\lceil\log_{2}(d^{2})\right\rceil}S_{k,l}=O\left(\frac{\lambda^{3/2}}{d}\right).$$

By symmetry of $k$ and $l$,

$$R_{1,1}=\sum_{1\leq k,l\leq\left\lceil\log_{2}(d^{2})\right\rceil}S_{k,l}=O\left(\frac{\lambda^{3/2}}{d}\right),$$

which completes the proof. ∎

Appendix C Instantiating Our Construction

Using our results to instantiate an efficient, secure split-state non-malleable code, we require a family of graphs $\{G_{k}\}_{k\in\mathbb{N}}$, where each $G_{k}=(V_{k},E_{k})$ is $d_{k}$-regular with spectral expansion $\lambda_{k}$, satisfying the following:

1. The function $\varepsilon(k)=\frac{\lambda_{k}^{3/2}}{d_{k}}$ is negligible.

2. We have $n_{k}=\left|V(G_{k})\right|=\Omega(d_{k}^{3}\log(d_{k})/\lambda_{k})$

3. Both sampling an edge $(u,v)\xleftarrow{u}E_{k}$ and sampling a non-edge $(u,v)\xleftarrow{u}(V_{k}\times V_{k})\setminus E_{k}$ can be done in time polynomial in $k$.

4. Determining membership of a pair $(u,v)\in V\times V$ in $E(G_{k})$ can be done deterministically in time polynomial in $k$.

Given such a family of graphs it is clear that the corresponding graph code $(\enc_{G_{k}},\dec_{G_{k}})$ is an efficiently computable non-malleable code.

C.1 Instantiation with High-Degree Cayley Graphs

Explicit constructions of such families of graphs do indeed exist. We shall here give an example from [Tre] from the class of graphs known as Cayley graphs. The construction is as follows.

Definition 10.

For $p$ a prime and $1\leq t<p$ let the graph $\LD_{p,t}$ have vertex set $\mathbb{F}_{p}^{t+1}$ and edge set

$$E(\LD_{p,t})=\left\{(x,x+(b,ab,a^{2}b,\dots,a^{t}b))\mid x\in\mathbb{F}_{p}^{t+1},a,b\in\mathbb{F}_{p}\right\},$$

i.e. $x,y\in V(\LD_{p,T})$ are connected by an edge if and only if there exists $a,b\in\mathbb{F}_{p}$ such that $y=x+(b,ab,a^{2}b,\dots,a^{t}b)$.

It is worth nothing that the graph $\LD_{p,t}$ is $\LD_{p,t}$ is $p^{2}$-regular and that it is undirected as $x$ is connected to $y$ if and only if $y$ is connected to $x$.

Now, let $t=5$ and for each $k\in\mathbb{N}$ let $p_{k}$ be some $k$-bit prime. We consider the family of graphs $\{\LD_{p_{k},5}\}_{k\in\mathbb{N}}$ for our instantiation. In the following, we shall check the criteria from the beginning of the section point by point.

1. The family of graphs $\LD_{p,t}$ has great expander properties.

   Theorem 11 (Trevisan [Tre]).

   For $1<t<p$, the graph $\LD_{p,t}$ is a $pt$-spectral expander.

   This fact allows us to note that for our particular choice of graphs, $\varepsilon(k)=\frac{(p_{k}t)^{3/2}}{p_{k}^{2}}<\frac{12}{\sqrt{p}_{k}}$, which in fact is $2^{-\Omega(k)}$ and the representation size is $O(k)$ bits.

2. We have $\Omega\left(\frac{d_{k}^{3}\log(d_{k})}{\lambda_{k}}\right)=\Omega(p^{5}\log(p))$ such that indeed,

   $$n_{k}=\left|V(\LD_{p_{k},5})\right|=p^{6}=\Omega\left(\frac{d_{k}^{3}\log(d_{k})}{\lambda_{k}}\right).$$

3. Sampling an edge $(u,v)\xleftarrow{u}E(\LD_{p_{k},t})$ is simply a question of picking $x\in\mathbb{F}_{p_{k}}^{t+1},a,b\in\mathbb{F}_{p_{k}}$ uniformly at random and then outputting the edge $(x,x+(b,ab,a^{2}b,\dots,a^{t}b))$.

   To pick a non-edge, simply sample two random vertices $u,v\in\mathbb{F}_{p_{k}}^{t+1}$ uniformly at random and check (with the procedure to be specified below) whether $(u,v)\in E(\LD_{p_{k},t})$. Since for $t>1$ the probability of hitting an edge with such a random choice is $\leq 1/{p_{k}}$, the expected number of repetitions is constant and hence the procedure takes expected polynomial time.

4. To test membership of some $(u,v)\in\left(\mathbb{F}_{p_{k}}^{t+1}\right)^{2}$ in $E(\LD_{p_{k},t})$, perform the following operation: Compute $x=u-v$ and write $x=(x_{0},\dots,x_{t})$. It is now trival to check whether $\left(1,\frac{x_{1}}{x_{0}},\dots,\frac{x_{t}}{x_{0}}\right)$ is of the form $(1,a,a^{2},\dots,a^{t})$.