Document Open Access Logo

Improving Lagarias-Odlyzko Algorithm for Average-Case Subset Sum: Modular Arithmetic Approach

Authors Antoine Joux , Karol Węgrzycki

PDF

File

Thumbnail PDF
PDF
LIPIcs.STACS.2026.57.pdf
  • Filesize: 0.9 MB
  • 19 pages

Document Identifiers

Related Versions

Subject Classification

ACM Subject Classification
  • Security and privacy → Cryptanalysis and other attacks
  • Theory of computation → Randomness, geometry and discrete structures
Keywords
  • Average-Case Analysis
  • Subset Sum
  • Lattice Reduction
  • LLL

Metrics

Abstract

Lagarias and Odlyzko (J.ACM 1985) proposed a polynomial-time algorithm for solving "almost all" instances of the Subset Sum problem with n integers of size Ω(Γ_LO), where log₂(Γ_LO) > n² log₂(γ) and γ is a parameter of the lattice basis reduction (γ > √{4/3} for LLL). The algorithm of Lagarias and Odlyzko is a cornerstone of cryptography. However, the theoretical guarantee on the density of feasible instances has remained unimproved for almost 40 years.
In this paper, we propose an algorithm that solves "almost all" instances of Subset Sum with integers of size Ω(√{Γ_LO}) after a single call to lattice reduction. Additionally, our approach allows solving the Subset Sum problem for multiple targets, whereas the previous method could handle only one target per call to lattice basis reduction. We introduce a modular arithmetic approach to the Subset Sum problem, leveraging lattice reduction to solve a linear system modulo a suitably large prime. By analyzing the lengths of the LLL-reduced basis vectors of both the primal and dual lattices simultaneously, we show that density guarantees can be improved.

Cite As Get BibTex

Antoine Joux and Karol Węgrzycki. Improving Lagarias-Odlyzko Algorithm for Average-Case Subset Sum: Modular Arithmetic Approach. In 43rd International Symposium on Theoretical Aspects of Computer Science (STACS 2026). Leibniz International Proceedings in Informatics (LIPIcs), Volume 364, pp. 57:1-57:19, Schloss Dagstuhl – Leibniz-Zentrum für Informatik (2026) https://doi.org/10.4230/LIPIcs.STACS.2026.57

Author Details

Antoine Joux
  • CISPA Helmholtz Center for Information Security, Saarbrücken, Germany
Karol Węgrzycki
  • Max Planck Institute for Informatics, Saarbrücken, Germany

Funding

  • Węgrzycki, Karol: Supported by the Deutsche Forschungsgemeinschaft (DFG, German Research Foundation) grant number 559177164.

References

  1. Divesh Aggarwal, Antoine Joux, Miklos Santha, and Karol Węgrzycki. Polynomial time algorithms for integer programming and unbounded subset sum in the total regime, 2024. URL: https://doi.org/10.48550/arXiv.2407.05435.
  2. Divesh Aggarwal, Zeyong Li, and Noah Stephens-Davidowitz. A 2^n/2-Time Algorithm for √n-SVP and √n-Hermite SVP, and an Improved Time-Approximation Tradeoff for (H)SVP. In Advances in Cryptology - EUROCRYPT 2021 - 40th Annual International Conference on the Theory and Applications of Cryptographic Techniques, volume 12696 of Lecture Notes in Computer Science, pages 467-497. Springer, 2021. URL: https://doi.org/10.1007/978-3-030-77870-5_17.
  3. Jonathan Allcock, Yassine Hamoudi, Antoine Joux, Felix Klingelhöfer, and Miklos Santha. Classical and quantum algorithms for variants of subset-sum via dynamic programming. In 30th Annual European Symposium on Algorithms, ESA 2022, volume 244 of LIPIcs, pages 6:1-6:18. Schloss Dagstuhl - Leibniz-Zentrum für Informatik, 2022. URL: https://doi.org/10.4230/LIPIcs.ESA.2022.6.
  4. Per Austrin, Petteri Kaski, Mikko Koivisto, and Jussi Määttä. Space-Time Tradeoffs for Subset Sum: An Improved Worst Case Algorithm. In Automata, Languages, and Programming - 40th International Colloquium, ICALP 2013, pages 45-56, 2013. URL: https://doi.org/10.1007/978-3-642-39206-1_5.
  5. Per Austrin, Petteri Kaski, Mikko Koivisto, and Jesper Nederlof. Subset Sum in the Absence of Concentration. In 32nd International Symposium on Theoretical Aspects of Computer Science, STACS 2015, pages 48-61, 2015. URL: https://doi.org/10.4230/LIPIcs.STACS.2015.48.
  6. Per Austrin, Petteri Kaski, Mikko Koivisto, and Jesper Nederlof. Dense Subset Sum May Be the Hardest. In 33rd Symposium on Theoretical Aspects of Computer Science, STACS 2016, pages 13:1-13:14, 2016. URL: https://doi.org/10.4230/LIPIcs.STACS.2016.13.
  7. Eleonore Bach, Friedrich Eisenbrand, Thomas Rothvoss, and Robert Weismantel. Forall-exist statements in pseudopolynomial time. In Proceedings of the 2025 Annual ACM-SIAM Symposium on Discrete Algorithms (SODA), pages 2225-2233. SIAM, 2025. URL: https://doi.org/10.1137/1.9781611978322.73.
  8. Nikhil Bansal, Shashwat Garg, Jesper Nederlof, and Nikhil Vyas. Faster Space-Efficient Algorithms for Subset Sum, k-Sum, and Related Problems. SIAM J. Comput., 47(5):1755-1777, 2018. URL: https://doi.org/10.1137/17M1158203.
  9. Anja Becker, Jean-Sébastien Coron, and Antoine Joux. Improved generic algorithms for hard knapsacks. In Annual International Conference on the Theory and Applications of Cryptographic Techniques, pages 364-385. Springer, 2011. URL: https://doi.org/10.1007/978-3-642-20465-4_21.
  10. Anja Becker, Antoine Joux, Alexander May, and Alexander Meurer. Decoding random binary linear codes in 2 n/20: How 1+ 1= 0 improves information set decoding. In Advances in Cryptology-EUROCRYPT 2012: 31st Annual International Conference on the Theory and Applications of Cryptographic Techniques, Cambridge, UK, April 15-19, 2012. Proceedings 31, pages 520-536. Springer, 2012. URL: https://doi.org/10.1007/978-3-642-29011-4_31.
  11. Richard Bellman. Dynamic Programming. Princeton University Press, Princeton, NJ, USA, 1957. Google Scholar
  12. Daniel J Bernstein, Stacey Jeffery, Tanja Lange, and Alexander Meurer. Quantum algorithms for the subset-sum problem. In Post-Quantum Cryptography: 5th International Workshop, PQCrypto 2013, Limoges, France, June 4-7, 2013. Proceedings 5, pages 16-33. Springer, 2013. URL: https://doi.org/10.1007/978-3-642-38616-9_2.
  13. Elena Böhme. Verbesserte subset-sum algorithmen. PhD thesis, Master’s thesis, Ruhr Universität Bochum, 2011. Google Scholar
  14. Xavier Bonnetain, Rémi Bricout, André Schrottenloher, and Yixin Shen. Improved classical and quantum algorithms for subset-sum. In Advances in Cryptology-ASIACRYPT 2020: 26th International Conference on the Theory and Application of Cryptology and Information Security, Daejeon, South Korea, December 7-11, 2020, Proceedings, Part II 26, pages 633-666. Springer, 2020. URL: https://doi.org/10.1007/978-3-030-64834-3_22.
  15. Murray R Bremner. Lattice basis reduction: an introduction to the LLL algorithm and its applications. CRC Press, 2011. Google Scholar
  16. Ernest F Brickell. Solving low density knapsacks. In Advances in Cryptology: Proceedings of Crypto 83, pages 25-37. Springer, 1984. Google Scholar
  17. Karl Bringmann. A Near-Linear Pseudopolynomial Time Algorithm for Subset Sum. In Proceedings of the Twenty-Eighth Annual ACM-SIAM Symposium on Discrete Algorithms, pages 1073-1084. SIAM, 2017. URL: https://doi.org/10.1137/1.9781611974782.69.
  18. Karl Bringmann. Knapsack with small items in near-quadratic time. In Proceedings of the 56th Annual ACM Symposium on Theory of Computing, pages 259-270, 2024. URL: https://doi.org/10.1145/3618260.3649719.
  19. Lin Chen, Yuchen Mao, and Guochuan Zhang. Long arithmetic progressions in sumsets and subset sums: Constructive proofs and efficient witnesses. In Proceedings of the 57th Annual ACM Symposium on Theory of Computing, pages 2086-2097, 2025. URL: https://doi.org/10.1145/3717823.3718281.
  20. Xi Chen, Yaonan Jin, Tim Randolph, and Rocco A. Servedio. Average-case subset balancing problems. In Proceedings of the 2022 Annual ACM-SIAM Symposium on Discrete Algorithms (SODA), pages 743-778, 2022. URL: https://doi.org/10.1137/1.9781611977073.33.
  21. Don Coppersmith. Finding a small root of a univariate modular equation. In Advances in Cryptology - EUROCRYPT '96, International Conference on the Theory and Application of Cryptographic Techniques, volume 1070 of Lecture Notes in Computer Science, pages 155-165. Springer, 1996. URL: https://doi.org/10.1007/3-540-68339-9_14.
  22. Matthijs J Coster, Antoine Joux, Brian A LaMacchia, Andrew M Odlyzko, Claus-Peter Schnorr, and Jacques Stern. Improved low-density subset sum algorithms. Computational complexity, 2:111-128, 1992. URL: https://doi.org/10.1007/BF01201999.
  23. Itai Dinur, Orr Dunkelman, Nathan Keller, and Adi Shamir. Efficient Dissection of Composite Problems, with Applications to Cryptanalysis, Knapsacks, and Combinatorial Search Problems. In Advances in Cryptology - CRYPTO 2012 - 32nd Annual Cryptology Conference. Proceedings, 2012. Google Scholar
  24. Alan M. Frieze. On the Lagarias-Odlyzko Algorithm for the Subset Sum Problem. SIAM J. Comput., 15(2):536-539, 1986. URL: https://doi.org/10.1137/0215038.
  25. Merrick L Furst and Ravi Kannan. Succinct certificates for almost all subset sum problems. SIAM Journal on Computing, 18(3):550-558, 1989. URL: https://doi.org/10.1137/0218037.
  26. Steven D Galbraith. Mathematics of public key cryptography. Cambridge University Press, 2012. Google Scholar
  27. Nicolas Gama and Phong Q Nguyen. Finding short lattice vectors within Mordell’s inequality. In Proceedings of the fortieth annual ACM symposium on Theory of computing, pages 207-216, 2008. URL: https://doi.org/10.1145/1374376.1374408.
  28. Alexander Helm and Alexander May. Subset sum quantumly in 1.17ⁿ. In 13th Conference on the Theory of Quantum Computation, Communication and Cryptography (TQC 2018). Schloss Dagstuhl - Leibniz-Zentrum für Informatik, 2018. URL: https://doi.org/10.4230/LIPIcs.TQC.2018.5.
  29. Ellis Horowitz and Sartaj Sahni. Computing Partitions with Applications to the Knapsack Problem. J. ACM, 21(2):277-292, 1974. URL: https://doi.org/10.1145/321812.321823.
  30. Nick Howgrave-Graham. Finding small roots of univariate modular equations revisited. In Cryptography and Coding, 6th IMA International Conference, volume 1355, pages 131-142. Springer, 1997. URL: https://doi.org/10.1007/BFB0024458.
  31. Nick Howgrave-Graham and Antoine Joux. New generic algorithms for hard knapsacks. In Annual International Conference on the Theory and Applications of Cryptographic Techniques, pages 235-256. Springer, 2010. URL: https://doi.org/10.1007/978-3-642-13190-5_12.
  32. Ce Jin. 0-1 Knapsack in nearly quadratic time. In Proceedings of the 56th Annual ACM Symposium on Theory of Computing, pages 271-282, 2024. URL: https://doi.org/10.1145/3618260.3649618.
  33. Antoine Joux, Hunter Kippen, and Julian Loss. A concrete analysis of wagner’s k-list algorithm over ℤ_p, 2024. Google Scholar
  34. Antoine Joux and Jacques Stern. Improving the Critical Density of the Lagarias-Odlyzko Attack Against Subset Sum Problems. In Fundamentals of Computation Theory, 8th International Symposium, FCT '91, volume 529, pages 258-264. Springer, 1991. URL: https://doi.org/10.1007/3-540-54458-5_70.
  35. Antoine Joux and Karol Wegrzycki. Improving lagarias-odlyzko algorithm for average-case subset sum: Modular arithmetic approach. CoRR, abs/2408.16108, 2024. URL: https://doi.org/10.48550/arXiv.2408.16108.
  36. Hans Kellerer, Ulrich Pferschy, and David Pisinger. Knapsack problems. Springer, 2004. URL: https://doi.org/10.1007/978-3-540-24777-7.
  37. Konstantinos Koiliaris and Chao Xu. Faster pseudopolynomial time algorithms for subset sum. ACM Transactions on Algorithms (TALG), 15(3):1-20, 2019. URL: https://doi.org/10.1145/3329863.
  38. J. C. Lagarias and Andrew M. Odlyzko. Solving low-density subset sum problems. J. ACM, 32(1):229-246, 1985. URL: https://doi.org/10.1145/2455.2461.
  39. Brian A LaMacchia. Basis reduction algorithms and subset sum problems. Technical report, Massachusetts Institute of Technology, 1991. Google Scholar
  40. Arjen K Lenstra, Hendrik Willem Lenstra, and László Lovász. Factoring polynomials with rational coefficients. Mathematische annalen, 261:515-534, 1982. Google Scholar
  41. Ralph C. Merkle and Martin E. Hellman. Hiding information and signatures in trapdoor knapsacks. IEEE Trans. Information Theory, 24(5):525-530, 1978. URL: https://doi.org/10.1109/TIT.1978.1055927.
  42. Jesper Nederlof and Karol Węgrzycki. Improving Schroeppel and Shamir’s Algorithm for Subset Sum via Orthogonal Vectors. In STOC '21: 53rd Annual ACM SIGACT Symposium on Theory of Computing, pages 1670-1683. ACM, 2021. URL: https://doi.org/10.1145/3406325.3451024.
  43. Phong Q Nguyen and Brigitte Vallée. The LLL algorithm. Springer, 2010. Google Scholar
  44. Andrew M Odlyzko. The rise and fall of knapsack cryptosystems. Cryptology and computational number theory, 42(2), 1990. Google Scholar
  45. Adam Polak, Lars Rohwedder, and Karol Węgrzycki. Knapsack and Subset Sum with Small Items. In 48th International Colloquium on Automata, Languages, and Programming, ICALP 2021, volume 198 of LIPIcs, pages 106:1-106:19. Schloss Dagstuhl - Leibniz-Zentrum für Informatik, 2021. URL: https://doi.org/10.4230/LIPIcs.ICALP.2021.106.
  46. Stanislaw Radziszowski and Donald Kreher. Solving subset sum problems with the L³ algorithm. The Charles Babbage Research Centre: The Journal of Combinatorial Mathematics and Combinatorial Computing, 3, 1988. Google Scholar
  47. Keegan Ryan and Nadia Heninger. Fast practical lattice reduction through iterated compression. In Advances in Cryptology - CRYPTO 2023, pages 3-36, Cham, 2023. Springer Nature Switzerland. URL: https://doi.org/10.1007/978-3-031-38548-3_1.
  48. Claus-Peter Schnorr. A hierarchy of polynomial time lattice basis reduction algorithms. Theoretical computer science, 53(2-3):201-224, 1987. URL: https://doi.org/10.1016/0304-3975(87)90064-8.
  49. Claus-Peter Schnorr and Martin Euchner. Lattice basis reduction: Improved practical algorithms and solving subset sum problems. Mathematical programming, 66:181-199, 1994. URL: https://doi.org/10.1007/BF01581144.
  50. Richard Schroeppel and Adi Shamir. A T=O(2^n/2), S=O(2^n/4) Algorithm for Certain NP-Complete Problems. SIAM J. Comput., 10(3):456-464, 1981. Google Scholar
  51. Andrew Shallue. An improved multi-set algorithm for the dense subset sum problem. In International Algorithmic Number Theory Symposium, pages 416-429. Springer, 2008. URL: https://doi.org/10.1007/978-3-540-79456-1_28.
Any Issues?
X

Feedback on the Current Page

CAPTCHA

Thanks for your feedback!

Feedback submitted to Dagstuhl Publishing

Could not send message

Please try again later or send an E-mail
© 2023-2025 Schloss Dagstuhl – LZI GmbH About DROPS Imprint Privacy Contact