I am reading "Efficient Cryptographic Schemes Provably as Secure as Subset Sum" by R. Impagliazzo and M. Naor (paper) and came across the following statement in the proof of Theorem 3.1 (pages 10-11):

Let $\ l(n) = (1-c)n \ $ for $ \ c > 0 \ $ ...

Given $a_1, a_2, \cdots, a_n \in \{0,1\}^{l(n)}$ and a target sum $T$, we construct an input to the collision finding algorithm as follows:

  1. Let the collision finding algorithm select a (non-empty) $ s_1 \in \{0,1\}^n $

  2. compute $T' = \sum_{i \in s_1} a_i$. Choose a random $j$ such that $j \in s_1$ and define $a_j' = a_j - T' + T$.

  3. Give the instance $a_1, a_2, \cdots , a_j', \cdots, a_n$ and $s_1$ to the algorithm that finds collisions. The algorithm attempts to find $s_2$ such that $f_{(a_1, a_2, \cdots, a_j', \cdots, a_n)}(s_2) = T'$.

If the algorithm returns $s_2$ that collides with $s_1$ and $j \notin s_2$, then $s_2$ is a solution to our original problem, since swapping $a_j$ and $a_j'$ does not affect the sum over $s_2$.

Where the emphasis is mine.

Where $f$ concatenates $\stackrel{\rightarrow}{a}$ with the sum of the $a_i$'s:

$$ f( \stackrel{\rightarrow}{ a } , S) = f_{(a_1, a_2, \cdots, a_n)}(S) = \ \stackrel{\rightarrow}{a}, \sum_{i \in S} a_i \mod 2^{l(n)} $$

(taken from the top of page 3 from the same paper).

For the life of me, I don't understand how $s_2$ is a solution to the original instance. Can someone elaborate on what they mean? What am I missing?

The above definition for the subset sum problem is, if I'm not mistaken, just another form of the pigeonhole subset sum problem (i.e. $\sum_j a_j < 2^n -1$ ). If I read the above right, they are claiming that, given an oracle that finds collisions, they can then construct a solution to the original (pigeonhole) subset sum problem but I do not see how this is done. Any help would be appreciated.

  • $\begingroup$ on item (1), did you mean $S \subseteq \{0,1\}^n$? use \subseteq if so; Oh, maybe the error is in item (2), where you add $a_i$ if the $i$th bit is 1? $\endgroup$
    – Ran G.
    Jun 21, 2012 at 22:05
  • $\begingroup$ please make the question more self contained. Specifically, what is $f$? $\endgroup$
    – Ran G.
    Jun 21, 2012 at 22:08
  • $\begingroup$ @RanG. I copied directly from the paper. I took "$s_1 \in \{0,1\}^n$" to mean an n-bit vector, "$i \in s_1$" to mean "choose all positions, $i$, in $s_1$ that are one" and "$j \in s_1$" to mean "choose a position, $j$, in bit vector $s_1$ whose value is one". $\endgroup$
    – user834
    Jun 21, 2012 at 22:10
  • $\begingroup$ @RanG. edited and added the definition of $f$. $\endgroup$
    – user834
    Jun 21, 2012 at 22:17

1 Answer 1


The way I understand it is the following.

Note that for $s_1$, $f_\vec{a'}(s_1)=T$ (because the sum was $T'$ and we replaced $a_j$ with $a'_j$ and we know that $j\in s_1$.

Now, they search for a collision, i.e., another $s_2$ such that $j\notin s_2$, but $f_\vec{a'}(s_2)=T$. (is there a typo there, having $T'$ instead?) Now, what is $f_\vec{a}(s_2)$? also $T$, right? since $j\notin s_2$...

Does it help?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.