Two Notes on Low-Density Subset Sum Algorithm

In this short extended abstract, we give two notes on low-density subset sum algorithm. One is, by extending the variables range from {0, 1}to {− 1,0,1} and allowing the weight be negative, to prove that almost all extended subset sum problems of density <0.488... would be solved in polynomial time with a single call to a lattice oracle. Another is, by only allowing the weights be negative, to point out that almost all corresponding subset sum problems whose density is smaller than the same density bound 0.9408... as [CLOS] would be solved in polynomial time by calling lattice oracle. These two extened subset sum problems have clear significance in cryptanalysis, since breaking some cryptosystems can be reduced to solving one of them. As a example, we give a application of our notes in cryptanalysis of Idempotent Element cryptosystem proposed by Pieprzyk and Rutkowski [PR].