We present a fast algorithm for the subset convolution problem: given functions f and g defined on the lattice of subsets of an n-element set N , compute their subset convolution f * g, defined for all S ⊆ N bywhere addition and multiplication is carried out in an arbitrary ring. Via Möbius transform and inversion, our algorithm evaluates the subset convolution in O(n 2 2 n ) additions and multiplications, substantially improving upon the straightforward O(3 n ) algorithm. Specifically, if the input functions have an integer range {−M, −M +1, . . . , M }, their subset convolution over the ordinary sum-product ring can be computed inÕ(2 n log M ) time; the notationÕ suppresses polylogarithmic factors. Furthermore, using a standard embedding technique we can compute the subset convolution over the max-sum or min-sum semiring inÕ(2 n M ) time. To demonstrate the applicability of fast subset convolution, we present the firstÕ(2 k n 2 + nm) algorithm for the Steiner tree problem in graphs with n vertices, k terminals, and m edges with bounded integer weights, improving upon theÕ(3 k n+2 k n 2 +nm) time bound of the classical DreyfusWagner algorithm. We also discuss extensions to recent O(2 n )-time algorithms for covering and partitioning problems (Björklund and Husfeldt, FOCS 2006; Koivisto, FOCS 2006).