New Generic Algorithms for Hard Knapsacks

Abstract

Abstract. In this paper, we study the complexity of solving hard knapsack problems, i.e., knapsacks with a density close to 1 where latticebased low density attacks are not an option. For such knapsacks, the current state-of-the-art is a 31-year old algorithm by Schroeppel and Shamir which is based on birthday paradox techniques and yields a running time ofÕ(2 n/2 ) for knapsacks of n elements and usesÕ(2 n/4 ) storage. We propose here two new algorithms which improve on this bound, finally lowering the running time down to eitherÕ(2 0.385 n ) orÕ(2 0.3113 n ) under a reasonable heuristic. We also demonstrate the practicality of these algorithms with an implementation.

Quantum Algorithms for the Subset-Sum Problem

“…Howgrave-Graham and Joux introduced this technique in [17] and obtained a subset-sum algorithm that costs just 2 (0.337...+o(1))n . Beware that [17] incorrectly claimed a cost of 2 (0.311...+o(1))n ; the underlying flaw in the analysis was corrected in [3] with credit to May and Meurer.…”

“…(Experiments indicate that the probability is somewhat worse, although still inverse polynomial in n, if all R ij1 are chosen to be identical, even if this set is randomized as discussed in [17]. The idea of choosing independent sets appeared in [4] with credit to Bernstein.…”

“…One can reasonably speculate that analogous quantum speedups can also be applied to the algorithms of [24] and [4]. However, establishing this will require considerable extra work, similar to the extra work of [24] and [4] compared to [17] and [3] respectively.…”

“…However, the algorithmic techniques used to attack subset-sum problems are among the central algorithmic techniques used to attack lattice problems and decoding problems. For example, the best attack known against code-based cryptography, at least asymptotically, is a very recent decoding algorithm by Becker, Joux, May, and Meurer [4], improving upon a decoding algorithm by May, Meurer, and Thomae [24]; the algorithm of [4] is an adaptation of a subset-sum algorithm by Becker, Coron, and Joux [3], improving analogously upon a subset-sum algorithm by Howgrave-Graham and Joux [17].…”

“…Specifically, we introduce a quantum algorithm that, under reasonable assumptions, uses at most 2 (0.241...+o(1))n qubit operations to solve a subset-sum problem. This algorithm combines quantum walks with the central "representations" idea of [17]. Table 1.1 compares this exponent 0.241 .…”