Lenstra–Lenstra–Lovász lattice basis reduction algorithm

The Lenstra–Lenstra–Lovász (LLL) lattice basis reduction algorithm is a polynomial time lattice reduction algorithm invented by Arjen Lenstra, Hendrik Lenstra and László Lovász in 1982. Given a basis <math>\mathbf{B} = \{ \mathbf{b}_1,\mathbf{b}_2, \dots, \mathbf{b}_d \}</math> with n-dimensional integer coordinates, for a lattice L (a discrete subgroup of Rⁿ) with <math> d \leq n </math>, the LLL algorithm calculates an LLL-reduced (short, nearly orthogonal) lattice basis in time <math display="block">\mathcal O(d^5n\log^3 B)</math> where <math>B</math> is the largest length of <math>\mathbf{b}_i</math> under the Euclidean norm, that is, <math>B = \max\left(\|\mathbf{b}_1\|_2, \|\mathbf{b}_2\|_2, \dots, \|\mathbf{b}_d\|_2\right)</math>.

The original applications were to give polynomial-time algorithms for factorizing polynomials with rational coefficients, for finding simultaneous rational approximations to real numbers, and for solving the integer linear programming problem in fixed dimensions.

LLL reduction

The precise definition of LLL-reduced is as follows: Given a basis

<math display="block">\mathbf{B}=\{ \mathbf{b}_1,\mathbf{b}_2, \dots, \mathbf{b}_n \},</math>

define its Gram–Schmidt process orthogonal basis

<math display="block">\mathbf{B}^*=\{ \mathbf{b}^*_1, \mathbf{b}^*_2, \dots, \mathbf{b}^*_n \},</math>

and the Gram-Schmidt coefficients

<math display="block">\mu_{i,j}=\frac{\langle\mathbf{b}_i,\mathbf{b}^*_j\rangle}{\langle\mathbf{b}^*_j,\mathbf{b}^*_j\rangle},</math> for any <math>1 \le j < i \le n</math>.

Then the basis <math>B</math> is LLL-reduced if there exists a parameter <math>\delta</math> in such that the following holds:

1. (size-reduced) For <math>1 \leq j < i \leq n\colon \left|\mu_{i,j}\right|\leq 0.5</math>. By definition, this property guarantees the length reduction of the ordered basis.
2. (Lovász condition) For k = 2,3,..,n <math> \colon \delta \Vert \mathbf{b}^*_{k-1}\Vert^2 \leq \Vert \mathbf{b}^*_k\Vert^2+ \mu_{k,k-1}^2\Vert

\mathbf{b}^*_{k-1}\Vert^2</math>.

Here, estimating the value of the <math>\delta</math> parameter, we can conclude how well the basis is reduced. Greater values of <math>\delta</math> lead to stronger reductions of the basis. Initially, A. Lenstra, H. Lenstra and L. Lovász demonstrated the LLL-reduction algorithm for <math>\delta = \frac{3}{4}</math>. Note that although LLL-reduction is well-defined for <math>\delta = 1</math>, the polynomial-time complexity is guaranteed only for <math>\delta</math> in <math>(0.25,1)</math>.

The LLL algorithm computes LLL-reduced bases. There is no known efficient algorithm to compute a basis in which the basis vectors are as short as possible for lattices of dimensions greater than 4. However, an LLL-reduced basis is nearly as short as possible, in the sense that there are absolute bounds <math>c_i > 1</math> such that the first basis vector is no more than <math>c_1</math> times as long as a shortest vector in the lattice,

the second basis vector is likewise within <math>c_2</math> of the second successive minimum, and so on.

Applications

An early successful application of the LLL algorithm was its use by Andrew Odlyzko and Herman te Riele in disproving the Mertens conjecture.

The LLL algorithm has found numerous other applications in MIMO detection algorithms and cryptanalysis of public-key encryption schemes: knapsack cryptosystems, RSA with particular settings, NTRUEncrypt, and so forth. The algorithm can be used to find integer solutions to many problems.

In particular, the LLL algorithm forms a core of one of the integer relation algorithms. For example, if it is believed that r=1.618034 is a (slightly rounded) root to an unknown quadratic equation with integer coefficients, one may apply LLL reduction to the lattice in <math>\mathbf{R}^4</math> spanned by <math>[1,0,0,10000r^2], [0,1,0,10000r],</math> and <math>[0,0,1,10000]</math>. The first vector in the reduced basis will be an integer linear combination of these three, thus necessarily of the form <math>[a,b,c,10000(ar^2+br+c)]</math>; but such a vector is "short" only if a, b, c are small and <math>ar^2+br+c</math> is even smaller. Thus the first three entries of this short vector are likely to be the coefficients of the integral quadratic polynomial which has r as a root. In this example the LLL algorithm finds the shortest vector to be [1, -1, -1, 0.00025] and indeed <math>x^2-x-1</math> has a root equal to the golden ratio, 1.6180339887....

Properties of LLL-reduced basis

Let <math>\mathbf{B}=\{ \mathbf{b}_1,\mathbf{b}_2, \dots, \mathbf{b}_n \}</math> be a <math>\delta</math>-LLL-reduced basis of a lattice <math>\mathcal L</math>. From the definition of LLL-reduced basis, we can derive several other useful properties about <math>\mathbf{B}</math>.

1. The first vector in the basis cannot be much larger than the shortest non-zero vector: <math>\Vert\mathbf{b}_1 \Vert \le (2 / (\sqrt{4\delta - 1}))^{n-1} \cdot \lambda_1(\mathcal L)</math>. In particular, for <math>\delta = 3/4</math>, this gives <math>\Vert\mathbf{b}_1 \Vert \le 2^{(n-1)/2} \cdot \lambda_1(\mathcal L)</math>.
2. The first vector in the basis is also bounded by the determinant of the lattice: <math>\Vert\mathbf{b}_1 \Vert \le (2 / (\sqrt{4\delta - 1}))^{(n-1)/2} \cdot (\det(\mathcal L))^{1/n}</math>. In particular, for <math>\delta = 3/4</math>, this gives <math>\Vert\mathbf{b}_1 \Vert \le 2^{(n-1)/4} \cdot (\det(\mathcal L))^{1/n}</math>.
3. The product of the norms of the vectors in the basis cannot be much larger than the determinant of the lattice: let <math>\delta = 3/4</math>, then <math display="inline">\prod_{i=1}^n \Vert\mathbf{b}_i \Vert \le 2^{n(n-1)/4} \cdot \det(\mathcal L)</math>.

LLL algorithm pseudocode

The following description is based on , with the corrections from the errata.

INPUT

a lattice basis b₁, b₂, ..., b_n in Z^m

a parameter δ with 1/4 < δ < 1, most commonly δ = 3/4

PROCEDURE

B^* <- GramSchmidt({b₁, ..., b_n}) = {b₁^*, ..., b_n^*}; and do not normalize

μ_i,j <- InnerProduct(b_i, b_j^*)/InnerProduct(b_j^*, b_j^*); using the most current values of b_i and b_j^*

k <- 2;

while k <= n do

for j from k−1 to 1 do

if |μ_k,j| > 1/2 then

b_k <- b_k − ⌊μ_k,j⌉b_j;

Update B^* and the related μ_i,j<nowiki/>'s as needed.

(The naive method is to recompute B^* whenever b_i changes:

B^* <- GramSchmidt({b₁, ..., b_n}) = {b₁^*, ..., b_n^*})

end if

end for

if InnerProduct(b_k^*, b_k^*) > (δ − μ²_k,k−1) InnerProduct(b_k−1^*, b_k−1^*) then

k <- k + 1;

else

Swap b_k and b_k−1;

Update B^* and the related μ_i,j<nowiki/>'s as needed.

k <- max(k−1, 2);

end if

end while

return B the LLL reduced basis of {b₁, ..., b_n}

OUTPUT

the reduced basis b₁, b₂, ..., b_n in Z^m

Examples

Example from Z³

Let a lattice basis <math> \mathbf{b}_1,\mathbf{b}_2, \mathbf{b}_3 \in \mathbf{Z}^{3}</math>, be given by the columns of

<math display="block">\begin{bmatrix}

1 & -1& 3\\

1 & 0 & 5\\

1 & 2 & 6

\end{bmatrix}</math>

then the reduced basis is

<math display="block">\begin{bmatrix}

0 & 1& -1\\

1 & 0 & 0\\

0 & 1 & 2

\end{bmatrix},</math>

which is size-reduced, satisfies the Lovász condition, and is hence LLL-reduced, as described above. See W. Bosma. for details of the reduction process.

Example from Z[i]⁴

Likewise, for the basis over the complex integers given by the columns of the matrix below,

<math display="block">\begin{bmatrix}

-2+2i & 7+3i & 7+3i & -5+4i\\

3+3i & -2+4i & 6+2i & -1+4i\\

2+2i & -8+0i & -9+1i & -7+5i\\

8+2i & -9+0i & 6+3i & -4+4i

\end{bmatrix},</math>

then the columns of the matrix below give an LLL-reduced basis.

<math display="block">\begin{bmatrix}

-6+3i & -2+2i & 2-2i & -3+6i \\

6-1i & 3+3i & 5-5i & 2+1i \\

2-2i & 2+2i & -3-1i & -5+3i \\

-2+1i & 8+2i & 7+1i & -2-4i \\

\end{bmatrix}.</math>

Implementations

LLL is implemented in

• Arageli as the function <code>lll_reduction_int</code>
• fpLLL as a stand-alone implementation
• FLINT as the function <code>fmpz_lll</code>
• GAP as the function <code>LLLReducedBasis</code>
• Macaulay2 as the function <code>LLL</code> in the package <code>LLLBases</code>
• Magma as the functions <code>LLL</code> and <code>LLLGram</code> (taking a gram matrix)
• Maple as the function <code>IntegerRelations[LLL]</code>
• Mathematica as the function <code>LatticeReduce</code>
• Number Theory Library (NTL) as the function <code>LLL</code>
• PARI/GP as the function <code>qflll</code>
• Pymatgen as the function <code>analysis.get_lll_reduced_lattice</code>
• SageMath as the method <code>LLL</code> driven by fpLLL and NTL
• Isabelle/HOL in the 'archive of formal proofs' entry <code>LLL_Basis_Reduction</code>. This code exports to efficiently executable Haskell.

See also

• Coppersmith method

Notes

References