Improved Generic Algorithms for Hard Knapsacks

Abstract

Abstract. At Eurocrypt 2010, Howgrave-Graham and Joux described an algorithm for solving hard knapsacks of density close to 1 in timeÕ(2 0.337n ) and memoryÕ(2 0.256n ), thereby improving a 30-year old algorithm by Shamir and Schroeppel. In this paper we extend the Howgrave-GrahamJoux technique to get an algorithm with running time down toÕ(2 0.291n ). An implementation shows the practicability of the technique. Another challenge is to reduce the memory requirement. We describe a constant memory algorithm based on cycle finding with running timeÕ(2 0.72n ); we also show a time-memory tradeoff.

Lattice Decoding Attacks on Binary LWE

“…There is also a meet-in-the-middle attack that requiresÕ(3 n/2 ) (respectively,Õ(2 n/2 )) space and time. One can also convert to ISIS and apply algorithms due to Howgrave-Graham and Joux [13] and Becker, Coron and Joux [5]. All such attacks can be defeated by taking n ≥ 200 (the storage requirement is a serious constraint).…”

Quantum Algorithms for the Subset-Sum Problem

“…Three decades later, Howgrave-Graham and Joux in [17, eprint version, Section 3.1] described the left-right split with a modulus as a "useful practical variant" of the Schroeppel-Shamir algorithm; Becker, Coron, and Joux stated in [3] that this was a "simpler but heuristic variant of Schroeppel-Shamir". A more general algorithm (with one minor restriction, namely a prime choice of modulus) had already been stated a few years earlier by Elsenhans and Jahnel; see [10, Section 4.2.1] and [11, page 2].…”

“…Howgrave-Graham and Joux introduced this technique in [17] and obtained a subset-sum algorithm that costs just 2 (0.337...+o(1))n . Beware that [17] incorrectly claimed a cost of 2 (0.311...+o(1))n ; the underlying flaw in the analysis was corrected in [3] with credit to May and Meurer.…”

“…One can reasonably speculate that analogous quantum speedups can also be applied to the algorithms of [24] and [4]. However, establishing this will require considerable extra work, similar to the extra work of [24] and [4] compared to [17] and [3] respectively.…”

“…However, the algorithmic techniques used to attack subset-sum problems are among the central algorithmic techniques used to attack lattice problems and decoding problems. For example, the best attack known against code-based cryptography, at least asymptotically, is a very recent decoding algorithm by Becker, Joux, May, and Meurer [4], improving upon a decoding algorithm by May, Meurer, and Thomae [24]; the algorithm of [4] is an adaptation of a subset-sum algorithm by Becker, Coron, and Joux [3], improving analogously upon a subset-sum algorithm by Howgrave-Graham and Joux [17].…”