The extended k-tree algorithm

Abstract

Consider the following problem: Given k = 2 q random lists of n-bit vectors, L 1 , . . . , L k , each of length m, find x 1 ∈ L 1 , . . . , x k ∈ L k such that x 1 + · · · + x k = 0, where + is the XOR operation. This problem has applications in a number of areas, including cryptanalysis, coding theory, finding shortest lattice vectors, and learning theory. The so-called k-tree algorithm, due to Wagner, solves this problem inÕ(2 q+n/(q+1) ) expected time provided the length m of the lists is large enough, specifically if m ≥ 2 n/(q+1) . In many applications, however, it is necessary to work with lists of smaller length, where the above algorithm breaks down. In this paper we generalize the algorithm to work for significantly smaller values of the list length m, all the way down to the threshold value for which a solution exists with reasonable probability. Our algorithm exhibits a tradeoff between the value of m and the running time. We also provide the first rigorous bounds on the failure probability of both our algorithm and that of Wagner.As a third contribution, we give an extension of this algorithm to the case where the vectors are not binary, but defined over an arbitrary finite field F r , and a solution to λ 1 x 1 +· · ·+λ k x k = 0 with λ i ∈ F * r and x i ∈ L i is sought.

Constructing Carmichael numbers through improved subset-product algorithms

“…Wagner's algorithm for the k-tree problem [17] has inspired an algorithm for the subset sum problem that gets faster as the density increases [10,14,11]. A recent paper by Howgrave-Graham and Joux [7] even gives improvements for most problems of density 1.…”

“…7 add a 0 to S ; /* Phase 2: continually pair products to reach identity in G */ 8 construct subgroups G i , 1 ≤ i ≤ with factor groups having size 2 ; 9 for i ← 1 to do 10 pair the element containing a 0 first to ensure it is included ; 11 pair elements of S whose product is in G i ; 12 return the history of any element in G = {1 G } ;…”

Using LDGM Codes and Sparse Syndromes to Achieve Digital Signatures

“…Finally, it is advisable to consider the most dangerous attacks against the CFS scheme. It was successfully attacked by exploiting syndrome decoding based on the generalized birthday algorithm [14], even if the proposed attacking algorithm was not the optimal generalization of the birthday algorithm [22]. If we do not take into account some further improvement due to the QC structure of the public key, these algorithms provide a huge work factor for the proposed system parameters, since they try to solve the decoding problem for a random code.…”

Improving the Performance of the SYND Stream Cipher

“…For = 2, a solution can be found in time 2 /2 using the standard birthday paradox. For > 2 Wagner's algorithm [33] and its extended variants [5,11,28,15] can be applied. When = 2 −1 and | | > 2 / , Wagner's algorithm can find at least one solution in time 2 / .…”