# A simple and efficient attack on the Merkle-Hellman knapsack cryptosystem

## TL;DR

This paper introduces a faster method to break the Merkle-Hellman knapsack cryptosystem by improving upon previous techniques.

## Contribution

An improved algorithm is presented for attacking the Merkle-Hellman cryptosystem with significantly reduced time complexity.

## Key findings

- A partial super-increasing sequence is recovered using the LLL algorithm on a low-dimensional lattice.
- Most of the plaintext can be recovered from the tail using the super-increasing knapsack problem.
- The improved method reduces the time complexity by a polynomial level compared to Shamir’s algorithm.

## Abstract

The Merkle-Hellman knapsack cryptosystem was one of the two earliest public key cryptosystems, which was invented by Merkle and Hellman in 1978. One can recover the equivalent keys by using Shamir’s method. The most time-consuming part of Shamir’s attack is to recover the critical intermediate parameters by solving an integer programming problem with a fixed number of variables, whose worst-case complexity is exponential of the number of variables. In this paper, we present an improved algorithm to analyze the basic Merkle-Hellman public key cryptosystem. The main idea is to recover a partial super-increasing sequence as equivalent private key, which is the main difference from Shamir’s. More precisely, we first obtain a super-increasing sequence by invoking the LLL algorithm on a special lattice with a small dimension. We can recover most part of the plaintext from the tail by solving the super-increasing knapsack problem. Finally, we get the first part of plaintext by solving a size-reduced knapsack problem. Experimental data shows that one can recover the whole plaintext in less than 1 second on a laptop for the typical parameters of the Merkle-Hellman cryptosystem, whose time complexity is reduced by a polynomial level compared with Shamir’s algorithm.