Improving Lagarias-Odlyzko Algorithm For Average-Case Subset Sum: Modular Arithmetic Approach

TL;DR

This paper enhances the Lagarias-Odlyzko algorithm for average-case Subset Sum, using modular arithmetic and lattice reduction to solve larger instances more efficiently and handle multiple targets simultaneously.

Contribution

It introduces a modular arithmetic approach that improves density guarantees and extends the algorithm to solve multiple targets with a single lattice reduction.

Findings

Solves Subset Sum instances with larger integers after one lattice reduction

Enables solving multiple targets simultaneously

Improves density guarantees for feasible instances

Abstract

Lagarias and Odlyzko (J.~ACM~1985) proposed a polynomial time algorithm for solving ``\emph{almost all}'' instances of the Subset Sum problem with $n$ integers of size $\Omega(\Gamma_{\text{LO}})$, where $\log_2(\Gamma_{\text{LO}}) > n^2 \log_2(\gamma)$ and $\gamma$ is a parameter of the lattice basis reduction ($\gamma > \sqrt{4/3}$ for LLL). The algorithm of Lagarias and Odlyzko is a cornerstone result in cryptography. However, the theoretical guarantee on the density of feasible instances has remained unimproved for almost 40 years. In this paper, we propose an algorithm to solve ``almost all'' instances of Subset Sum with integers of size $\Omega(\sqrt{\Gamma_{\text{LO}}})$ after a single call to the lattice reduction. Additionally, our argument allows us to solve the Subset Sum problem for multiple targets while the previous approach could only answer one target per call to lattice basis reduction. We introduce a modular arithmetic approach to the Subset Sum problem. The idea is to use the lattice reduction to solve a linear system modulo a suitably large prime. We show that density guarantees can be improved, by analysing the lengths of the LLL reduced basis vectors, of both the primal and the dual lattices simultaneously.