An Improved Multi-set Algorithm for the Dense Subset Sum Problem

Shallue, Andrew

doi:10.1007/978-3-540-79456-1_28

Cited by 13 publications

(14 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The failure probability given by Theorem 4.1 differs at first sight qualitatively from those in [11,14] for the special case of Wagner's algorithm in that it does not decay to zero with the list length. However, our bound applies to the optimal algorithm for given n, m, q and c, while in [11,14] the list length m is required to be larger by a factor of α in order to achieve the bound on the failure probability (which decays exponentially with α). Obviously, since we achieve a constant failure probability for the given list length m, increasing the list length by a factor of α would allow us to run α independent trials of our algorithm, which also causes the failure probability to decrease exponentially with α.…”

Section: Bounding the Failure Probabilitymentioning

confidence: 85%

“…In this construction, the length of the lists has to be roughly the square of the length that Wagner's algorithm prescribes. In 2008, Shallue [14] modified Lyubashevsky's algorithm so that the merging step selects a larger subset of valid pairs. As a result, in order to achieve non-trivial failure probability the lists need to be of length O(m log m) where m is the length required by Wagner's algorithm.…”

Section: Related Workmentioning

confidence: 99%

“…. , x k ∈ L k such that x 1 + · · · + x k = 0 mod p. While some progress has been made on analyzing such an algorithm (see, e.g., [11,14]), the optimal choice of the parameters is not yet known. The analysis of our paper does not directly carry over, since the partial sums in the nodes are not uniformly distributed.…”

Section: Estimating the Expected Covariancementioning

confidence: 99%

See 2 more Smart Citations

The Extended k-tree Algorithm

Minder

Sinclair

2011

J Cryptol

View full text Add to dashboard Cite

Abstract. Consider the following problem: Given k = 2 q random lists of n-bit vectors,where + is the XOR operation. This problem has applications in a number of areas, including cryptanalysis, coding theory, finding shortest lattice vectors, and learning theory. The so-called k-tree algorithm, due to Wagner, solves this problem iñ O(2 q+n/(q+1) ) expected time provided the length m of the lists is large enough, specifically if m ≥ 2 n/(q+1) .In many applications, however, it is necessary to work with lists of smaller length, where the above algorithm breaks down. In this paper we generalize the algorithm to work for significantly smaller values of the list length m, all the way down to the threshold value for which a solution exists with reasonable probability. Our algorithm exhibits a tradeoff between the value of m and the running time. We also provide the first rigorous bounds on the failure probability of both our algorithm and that of Wagner.As a third contribution, we give an extension of this algorithm to the case where the vectors are not binary, but defined over an arbitrary finite field F r , and a solution to λ 1 x 1 + · · · + λ k x k = 0 with λ i ∈ F * r and x i ∈ L i is sought.

show abstract

Section: Bounding the Failure Probabilitymentioning

confidence: 85%

Section: Related Workmentioning

confidence: 99%

Section: Estimating the Expected Covariancementioning

confidence: 99%

See 1 more Smart Citation

The Extended k-tree Algorithm

Minder

Sinclair

2011

J Cryptol

View full text Add to dashboard Cite

show abstract

“…The hardness of breaking SS(n, M ) depends on the ratio between n and log M , which is usually referred to as the density of the subset sum instance. When n/log M is less than 1/n or larger than n/log 2 n, the problem can be solved in polynomial time [LO85,Fri86,FP05,Lyu05,Sha08]. However, when the density is constant or even as small as O(1/log n), there are currently no algorithms that require less than 2 Ω(n) time.…”

Section: Introductionmentioning

confidence: 99%

Public-Key Cryptographic Primitives Provably as Secure as Subset Sum

Lyubashevsky

Palacio

Segev

2010

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. We propose a semantically-secure public-key encryption scheme whose security is polynomial-time equivalent to the hardness of solving random instances of the subset sum problem. The subset sum assumption required for the security of our scheme is weaker than that of existing subset-sum based encryption schemes, namely the lattice-based schemes of Ajtai and Dwork (STOC'97), Regev (STOC'03, STOC'05), and Peikert (STOC'09). Additionally, our proof of security is simple and direct. We also present a natural variant of our scheme that is secure against key-leakage attacks, and an oblivious transfer protocol that is secure against semi-honest adversaries.

show abstract

“…The hardness of SS(n, q) depends on the so-called density, which is defined by the ratio δ := n/ log q. In case δ < 1/n or δ > n/ log 2 n, the problem can be solved in polynomial time [20,13,12,21,32]. In case δ is o(1) or even as small as O(1/ log n), the problem is considered to be hard.…”

Section: Introductionmentioning

confidence: 99%

Chosen-Ciphertext Security from Subset Sum

Faust

Masny

Venturi

2016

Public-Key Cryptography – PKC 2016

View full text Add to dashboard Cite

Abstract. We construct a public-key encryption (PKE) scheme whose security is polynomial-time equivalent to the hardness of the Subset Sum problem. Our scheme achieves the standard notion of indistinguishability against chosen-ciphertext attacks (IND-CCA) and can be used to encrypt messages of arbitrary polynomial length, improving upon a previous construction by Lyubashevsky, Palacio, and Segev (TCC 2010) which achieved only the weaker notion of semantic security (IND-CPA) and whose concrete security decreases with the length of the message being encrypted. At the core of our construction is a trapdoor technique which originates in the work of Micciancio and Peikert (Eurocrypt 2012).

show abstract

An Improved Multi-set Algorithm for the Dense Subset Sum Problem

Cited by 13 publications

References 12 publications

The Extended k-tree Algorithm

The Extended k-tree Algorithm

Public-Key Cryptographic Primitives Provably as Secure as Subset Sum

Chosen-Ciphertext Security from Subset Sum

Contact Info

Product

Resources

About