A Polynomial-Time Algorithm for Solving the Hidden Subset Sum Problem
- 831 Downloads
At Crypto ’99, Nguyen and Stern described a lattice based algorithm for solving the hidden subset sum problem, a variant of the classical subset sum problem where the n weights are also hidden. While the Nguyen-Stern algorithm works quite well in practice for moderate values of n, we argue that its complexity is actually exponential in n; namely in the final step one must recover a very short basis of a n-dimensional lattice, which takes exponential-time in n, as one must apply BKZ reduction with increasingly large block-sizes.
In this paper, we describe a variant of the Nguyen-Stern algorithm that works in polynomial-time. The first step is the same orthogonal lattice attack with LLL as in the original algorithm. In the second step, instead of applying BKZ, we use a multivariate technique that recovers the short lattice vectors and finally the hidden secrets in polynomial time. Our algorithm works quite well in practice, as we can reach \(n \simeq 250\) in a few hours on a single PC.
- [CG20]Coron, J.-S., Gini, A.: A polynomial-time algorithm for solving the hidden subset sum problem. Full version of this paper. Cryptology ePrint Archive, Report 2020/461 (2020). https://eprint.iacr.org/2020/461
- [CKPS00]Courtois, N., Klimov, A., Patarin, J., Shamir, A.: Efficient algorithms for solving overdefined systems of multivariate polynomial equations. In: Preneel, B. (ed.) EUROCRYPT 2000. LNCS, vol. 1807, pp. 392–407. Springer, Heidelberg (2000). https://doi.org/10.1007/3-540-45539-6_27CrossRefGoogle Scholar
- [fpl16]The FPLLL development team. FPLLL, a lattice reduction library (2016). https://github.com/fplll/fplll
- [LT15]Lepoint, T., Tibouchi, M.: Cryptanalysis of a (somewhat) additively homomorphic encryption scheme used in PIR. In: Brenner, M., Christin, N., Johnson, B., Rohloff, K. (eds.) FC 2015. LNCS, vol. 8976, pp. 184–193. Springer, Heidelberg (2015). https://doi.org/10.1007/978-3-662-48051-9_14CrossRefGoogle Scholar
- [Sag19]The Sage Developers. Sagemath, the Sage Mathematics Software System (Version 8.9) (2019). https://www.sagemath.org
- [Sho]Shoup, V.: Number theory C++ library (NTL) version 3.6. http://www.shoup.net/ntl/