Attacking the Chor-Rivest Cryptosystem by Improved Lattice Reduction

We introduce algorithms for lattice basis reduction that are improvements of the famous L3-algorithm. If a random L3-reduced lattice basis b1, . . . , bn, is given such that the vector of reduced Gram-Schmidt coefficients ({µi, j} 1 ≤ j < i ≤ n) is uniformly distributed in (0, 1)(n 2), then the pruned enumeration finds with positive probability a shortest lattice vector. We demonstrate the power of these algorithms by solving random subset sum problems of arbitrary density with 74 and 82 many weights, by breaking the Chor-Rivest cryptoscheme in dimensions 103 and 151 and by breaking Damgard's hash function.