How to attack Merkle-Hellman cryptosystem if the first element in the superincreasing series is too small?

54 Views Asked by At

In An Introduction to Mathematical Cryptography Jeffrey Hoffstein et al. claim that "It turns out that if $r_1$ is too small, then there are easy attacks, so we must insist that $r_1>2^n$." Here $r_1$ is the first element of the superincreasing series used in the Merkle-Hellman cryptosystem before it is disguised with modular arithmetic and $n$ is the number of elements in the series. Does anyone have information on how these attacks might work or a basic explanation of why too small $r_1$ is unsafe?