Trapdoors in Knapsack Kryptosystems

Abstract

A way to attack public-key cryptosystems based on the knapsack problem is proposed. The basic idea of the approach described is to find p a i r s of natural numbers, namely values for a modulus m and a multiplier w, which reduce the knapsack elements simultaneously by modular multiplication. The ratio r=w/m plays an overriding role.---T. Beth (Ed.): Cryptography

PKCHD: Towards a Probabilistic Knapsack Public-Key Cryptosystem with High Density

“…Knapsack-type PKCs always follows a common design morphology [9], that is: In the knapsack public-key cryptography, several kinds of easy knapsack problems have been considered, e.g., super-increasing sequences [4], the cargo vectors used in the Graham-Shamir cryptosystem [40] and the knapsack sequences [41] used for attacking a knapsack-type cryptosystem [16] based on Diophantine equations. In this section, we propose several new easy knapsack problems, which can be viewed as the generalizations of those problems presented in [42,43].…”

“…In fact, Refs. [42,43] have given a small example in which the message plaintext is not the shortest vector no matter what norms are used. Thus, the lattice reduction algorithms just find a random vector in the N(n, r) preimages.…”

A multiple-iterated trapdoor for dense compact knapsacks

“…The original trapdoor corresponds to bki a k i , U k = (wk) -1 rn.od pt, and Vk = p/C, for k = 1 to r. To make these equations linear, V ~ is set to an arbitrary constant. Consequently, one is not likely to find the original trapdoor but alternate trapdoors can return an alternate superincreasing series according to the following Lemma due to Desmedt, Vanderwalle, and Govaerts [20] and independently Eier and Lagger [18]. The first stage of Brickell's attack is to find the h/k's of (8) by finding short vectors in a lattice containing the public weights a r, for i = 1 to n. Numerous other knapsack cryptosystems and cryptanalytical attacks are reviewed in [2]- [5].…”

Applied cryptography: Protocols, algorithms, and source code in C

“…Then, Shamir showed that knapsacks can be broken in certain circumstances [1415,1416]. There were other results- [1428,38,754,516,488]but no one could break the general Merkle-Hellman system. Finally, Shamir and Zippel [1418,1419,1421] found flaws in the transformation that allowed them to reconstruct the superincreasing knapsack from the normal knapsack.…”