一般情況下, 子集合問題被認為是難解的問題.
但在 1983 年 Lagarias 與 Odlyzko 所發表的機率式演算法可以在多項式時間內解低密度的子集合問題.
而在 1991 年 Coster 等人所發表的改進作法, 使得較高密度的子集合問題被證明可解.
這兩個演算法都是將子集和問題化約到 Lattice 上找最短非零向量的問題上.

本篇論文提出了一個新的觀點來定義這兩個機率式演算法所能解的子集合問題,
並說明改進的演算法並非在所有情況下都優於原先的方法,
接著利用實驗來驗證我們的想法,
最後我們發現當解中 1 的個數大於 0.7733n 或小於 0.2267n 時,
即使子集和問題的密度趨近於 1,
Lagrias-Odlyzko 演算法仍然能證明可解這樣高密度的子集和問題.

In general, subset sum problem is strongly believed to be computationally difficult to solve.
But in 1983,
Lagarias and Odlyzko proposed a probabilistic algorithm for solving subset sum problems of sufficiently low density
in polynomial time.
In 1991, Coster et. al. improved the Lagarias-Odlyzko algorithm and solved subset sum problems with higher density.
Both algorithms reduce subset sum problem to finding shortest non-zero vectors in special lattices.

In this thesis,
we first proposed a new viewpoint to define the problems which can be solved by this two algorithms
and shows the improved algorithm isn't always better than the Lagarias-Odlyzko algorithm.
Then we verify this notion by experimentation.
Finally, we find that the Lagrias-Odlyzko algorithm can solve the high-density subset sum problems
if the weight of solution is higher than 0.7733n or lower than 0.2267n, even the density is close to 1.

1 簡介
1.1 前言
1.2 研究動機與內文大綱
2 子集和問題
2.1 定義
2.2 演算法
2.2.1 Exhaustive-Search
2.2.2 Meet-in-the-middle
2.2.3 Dynamic Programming
2.3 基於子集和問題的公開金鑰密碼系統
2.3.1 Merkle-Hellman 密碼系統
2.3.2 高密度背包演算法
3 Lattice
3.1 定義
3.2 簡化基底
3.3 LLL演算法
4 機率式演算法
4.1 Lagarias-Odlyzko 演算法
4.2 Coster 等人的改進做法
4.3 比較
5 可解問題的完整分析
5.1 想法與分析
5.2 實作測試
5.3 應用與討論
6 結論與未來展望

[1] Leonard M. Adleman. On breaking generalized knapsack public key
cryptosystems. In STOC ’83: Proceedings of the fifteenth annual ACM
symposium on Theory of computing, pages 402–412, New York, NY,
USA, 1983. ACM Press.
[2] M. Ajtai. The shortest vector problem in l_2 is NP-Hard for randomized
reductions. In Proceeding of the 30th Annual ACM Symposium on
Theory of Computing, pages 10–19, Dallas, Texas, May 1997.
[3] Ernest F. Brickell and Andrew M. Odlyzko. Cryptanalysis: A survey of
recent results. In Proceedings of the IEEE, volume 76, pages 578–593,
1988.
[4] Don Coppersmith. Finding small solutions to small degree polynomials.
In CALC: International Conference on Cryptography and Lattices,
CaLC, LNCS, 2001.
[5] T. H. Cormen, C. E. Leiserson, and R. L. Rivest. Introduction to algorithms,
pages 951–953. The MIT Press and McGraw-Hill Book Company,
1990.
[6] Matthijs J. Coster, Antoine Joux, Brian A. LaMacchia, Andrew M.
Odlyzko, Claus-Peter Schnorr, and Jacques Stern. Improved low-density
subset sum algorithms. Comput. Complex., 2(2):111–128, 1992.
[7] W. Diffie and M. E. Hellman. New directions in cryptography, Nov.
1976.
[8] A. M. Frieze. On the lagarias-odlyzko algorithm for the subset sum
problem. SIAM Journal on Computing, 15(2):536–539, May 1986.
[9] A. Joux and J. Stern. Lattice reduction: A toolbox for the cryptanalyst.
Journal of Cryptology, 11(3):161–185, 1998.
[10] Michael Kaib and Class P. Schnorr. The generalized gauss reduction
algorithm. Journal of Algorithm, 21(3):565–578.
[11] J. C. Lagarias and A. M. Odlyzko. Solving low-density subset sum
problems. J. ACM, 32(1):229–246, 1985.
[12] C. S. Laih, J. Y. Lee, L. Harn, and Y. K. Su. Linearly shift knapsack
public-key cryptosystem. IEEE Journal on Selected Areas in Communications,
7(4):534–539, MAY 1989.
[13] A. K. Lenstra, Jr. H. W. Lenstra, and L. Lov´asz. Factoring polynomails
with rational coeffiecients. Mathematische Annalen, 261:515–534, 1982.
[14] Ralph C. Merkle and Martin E. Hellman. Hiding information and signatures
in trap door knapsacks. IEEE Transactions on Information
Theory, 24(5):525–530, 1978.
[15] R. L. Rivest, A. Shamir, and L. M. Adleman. A method for obtaining
digital signatures and public-key cryptosystems. Communications of the
ACM, 21(2):120–126, 1978.
[16] C. P. Schnorr and M. Euchner. Lattice basis reduction: Improved practical
algorithms and solving subset sum problems. Mathematical Programming,
66:181–191, 1994.
[17] Adi Shamir. A polynomial-time algorithm for breaking the basic merklehellman
cryptosystem. IEEE Transactions on Information Theory,
30(5):699–704, 1984.
[18] V. Shoup. NTL: A library for doing number theory.