Performance analysis of Shamir's attack on the basic Merkle-Hellman knapsack cryptosystem

Abstract

This paper gives a performance analysis of one variant of Shamir's attack on the basic Merkle-Hellman knapsack cryptosystem, which we call Algorithm S. Let $R = \frac{{\# plain text bits}}{{maximum \# cipher text bits}}$ denote the rate at which a knapsack cryptosystem transmits information, and let n denote the number of items in a knapsack, i.e. the block size of plaintext. We show that for any fixed R Algorithm S runs to completion in time polynomial in n on all knapsacks with rate R _o>-R. We show that it successfully breaks at least the fraction $1 - \frac{{c_R }}{n}$ of such knapsack cryptosystems as n → ∞, where c _R is a constant depending on R.