Division algorithms for the fixed weight subset sum problem

Given positive integers a1, . . . , an, t, the fixed weight subset sum problem is to find a subset of the ai that sum to t, where the subset has a prescribed number of elements. It is this problem that underlies the security of modern knapsack cryptosystems, and solving the problem results directly in a message attack. We present new exponential algorithms that do not rely on lattices, and hence will be applicable when lattice basis reduction algorithms fail. These algorithms rely on a generalization of the notion of splitting system given by Stinson [18]. In particular, if the problem has length n and weight l then for constant k a power of two less than n we apply a k-set birthday algorithm to the splitting system of the problem. This randomized algorithm has time and space complexity that satisfies T · S k = Õ( (n l ) ) (where the constant depends uniformly on k). In addition to using space efficiently, the algorithm is highly parallelizable. Author’s Foreword January 2012 While the present paper was being refereed, [5] came out with an improvement to the main result. The most interesting aspect that remains is the idea of a k-set splitting system. 1. Problem Statement Let a1, . . . , an and a target t be positive integers. The l-weight subset sum problem is to find a subset of the ai that sum to t, where the subset has l elements. Equivalently, the problem is to find a bit vector x of length n and Hamming weight l such that