Knapsack Cryptosystem
Time limit3sMemory limit512 MB
Recover the plaintext bits from a Merkle-Hellman knapsack instance where q = 2^64, exploiting the known modulus to invert the hidden superincreasing sequence.
- Level
Hard8 of 10
- Topics
- Number theory, Brute force, Bit manipulation, Math
- Solved
- No attempts yet
Problem
The Merkle-Hellman knapsack cryptosystem is one of the first public key cryptosystems. Ralph Merkle and Martin Hellman published it in 1978. It works like this.
Alice picks positive integers such that holds for every , a positive integer greater than , and a positive integer coprime with . These integers are Alice's private key.
Alice then computes . These integers are Alice's public key.
Knowing the public key, Bob can send Alice a message of bits. He computes , the sum of the over the indices where his message has bit 1. The value is the encrypted message.
An eavesdropper Eve, who knows the public key and the encrypted message, has to solve an instance of the knapsack problem, which is presumably hard. Alice, on the other hand, recovers the message in linear time once she receives .
This problem is about an implementation in which Alice chose for obvious performance reasons and published that choice. Since everyone knows her , she asks Bob to send the value taken modulo , which keeps the communication simple.
Break this implementation. Given the public key and an encrypted message, restore the original message.
Input
The first line contains one integer ().
Each of the next lines contains one integer ().
The last line contains , the encrypted message taken modulo ().
The given sequence is a valid public key of the implementation above, and the given value is a valid encrypted message.
Output
Print exactly characters on one line, each of them 0 or 1, the bits of the original message in order.
Exactly one message fits the input, because the subset sums of are pairwise different.