Solving low-density subset sum problems

TLDR

The subset sum problem, a 0‑1 integer programming task, is NP‑complete and underpins knapsack‑type public‑key cryptosystems. The authors propose an algorithm that searches for a solution to a given subset sum instance. The algorithm transforms the instance into a lattice vector search, applies the LLL reduction to find a short vector, and is guaranteed to terminate in polynomial time, though it may fail to locate a solution. For most low‑density instances (density < 0.645) the algorithm finds the shortest lattice vector, and empirical evidence shows it succeeds for densities up to a cutoff dc(n) > 1/n, enabling a polynomial‑time attack on knapsack cryptosystems below that density.

Abstract

The subset sum problem is to decide whether or not the 0-l integer programming problem Σ n i=l a i x i = M , ∀I , x I = 0 or 1, has a solution, where the a i and M are given positive integers. This problem is NP-complete, and the difficulty of solving it is the basis of public-key cryptosystems of knapsack type. An algorithm is proposed that searches for a solution when given an instance of the subset sum problem. This algorithm always halts in polynomial time but does not always find a solution when one exists. It converts the problem to one of finding a particular short vector v in a lattice, and then uses a lattice basis reduction algorithm due to A. K. Lenstra, H. W. Lenstra, Jr., and L. Lovasz to attempt to find v. The performance of the proposed algorithm is analyzed. Let the density d of a subset sum problem be defined by d = n /log 2 (max i a i ). Then for “almost all” problems of density d &lt; 0.645, the vector v we searched for is the shortest nonzero vector in the lattice. For “almost all” problems of density d &lt; 1/ n , it is proved that the lattice basis reduction algorithm locates v. Extensive computational tests of the algorithm suggest that it works for densities d &lt; d c ( n ), where d c ( n ) is a cutoff value that is substantially larger than 1/ n . This method gives a polynomial time attack on knapsack public-key cryptosystems that can be expected to break them if they transmit information at rates below d c ( n ), as n → ∞.