**A Polynomial-Time Algorithm for Solving the Hidden Subset Sum Problem**

*Jean-Sébastien Coron and Agnese Gini*

**Abstract: **At Crypto ’99, Nguyen and Stern described a lattice based algorithm for solving the hidden subset sum problem, a variant of the classical subset sum problem where the n weights are also hidden. While the Nguyen-Stern algorithm works quite well in practice for moderate values of n, we argue that its complexity is actually exponential in n; namely in the final step one must recover a very short basis of a n-dimensional lattice, which takes exponential-time in n, as one must apply BKZ reduction with increasingly large block-sizes.
In this paper, we describe a variant of the Nguyen-Stern algorithm that works in polynomial-time. The first step is the same orthogonal lattice attack with LLL as in the original algorithm. In the second step, instead of applying BKZ, we use a multivariate technique that recovers the short lattice vectors and finally the hidden secrets in polynomial time. Our algorithm works quite well in practice, as we can reach n=250 in a few hours on a single PC.

**Category / Keywords: **public-key cryptography / Subset-sum problem, lattice cryptanalysis, LLL.

**Original Publication**** (with minor differences): **IACR-CRYPTO-2020

**Date: **received 21 Apr 2020, last revised 1 Jun 2020

**Contact author: **jscoron at gmail com,agnese gini@uni lu

**Available format(s): **PDF | BibTeX Citation

**Version: **20200601:185853 (All versions of this report)

**Short URL: **ia.cr/2020/461

[ Cryptology ePrint archive ]