The Lenstra–Lenstra–Lovász (LLL) lattice basis reduction algorithm is a polynomial time lattice reduction algorithm invented by Arjen Lenstra, Hendrik Lenstra and László Lovász in 1982. Given a basis with n-dimensional integer coordinates, for a lattice L (a discrete subgroup of Rn, the LLL algorithm calculates an LLL-reduced (short, nearly orthogonal under the Euclidean norm.

The original applications were to give polynomial-time algorithms for factorizing polynomials with rational coefficients, for finding simultaneous rational approximations to real numbers, and for solving the integer linear programming problem in fixed dimensions.

LLL reduction

The precise definition of LLL-reduced is as follows: Given a basis define its Gram–Schmidt process.

in such that the following holds:

1. . By definition, this property guarantees the length reduction of the ordered basis.

2. .

.

The LLL algorithm computes LLL-reduced bases. There is no known efficient algorithm to compute a basis in which the basis vectors are as short as possible for lattices of dimensions greater than 4. of the second successive minimum, and so on.

Applications

An early successful application of the LLL algorithm was its use by Andrew Odlyzko and Herman te Riele in disproving the Mertens conjecture.

The LLL algorithm has found numerous other applications in MIMO detection algorithms and cryptanalysis of public-key encryption schemes: knapsack cryptosystems, RSA with particular settings, NTRUEncrypt, and so forth. The algorithm can be used to find integer solutions to many problems.

In particular, the LLL algorithm forms a core of one of the integer relation algorithms. For example, if it is believed that r=1.618034 is a (slightly rounded) root to an unknown quadratic equation. The first vector in the reduced basis will be an integer linear combination; but such a vector is "short" only if a, b, c is even smaller. Thus the first three entries of this short vector are likely to be the coefficients of the integral quadratic polynomial which has r has a root equal to the golden ratio, 1.6180339887....

Properties of LLL-reduced basis

-LLL-reduced basis of a lattice.

1. The first vector in the basis cannot be much larger than the shortest non-zero vector.

2. .

3. .

LLL algorithm pseudocode

The following description is based on , with the corrections from the errata.

INPUT
    a lattice basis b1, b2, ..., bn in Zm
    a parameter δ with 1/4 < δ < 1, most commonly δ = 3/4
PROCEDURE
    B* <- GramSchmidt({b1, ..., bn}) = {b1*, ..., bn*};  and do not normalize
    μi,j <- InnerProduct(bi, bj*)/InnerProduct(bj*, bj*);   using the most current values of bi and bj*
    k <- 2;
    while k <= n do
        for j from k−1 to 1 do
            if |μk,j| > 1/2 then
                bk <- bk − ⌊μk,j⌉bj;
               Update B* and the related μi,j's as needed.
               (The naive method is to recompute B* whenever bi changes:
                B* <- GramSchmidt({b1, ..., bn}) = {b1*, ..., bn*})
            end if
        end for
        if InnerProduct(bk*, bk*) > (δ − μ2k,k−1) InnerProduct(bk−1*, bk−1*) then
            k <- k + 1;
        else
            Swap bk and  bk−1;
            Update B* and the related μi,j's as needed.
            k <- max(k−1, 2);
        end if
    end while
    return B the LLL reduced basis of {b1, ..., bn}
OUTPUT
    the reduced basis b1, b2, ..., bn in Zm

Examples

Example from Z3

which is size-reduced, satisfies the Lovász condition, and is hence LLL-reduced, as described above. See W. Bosma. for details of the reduction process.

Example from Z[i]4

Implementations

LLL is implemented in

• Arageli as the function lll_reduction_int

• fpLLL as a stand-alone implementation

• FLINT as the function fmpz_lll

• GAP as the function LLLReducedBasis

• Macaulay2 as the function LLL in the package LLLBases

• Magma as the functions LLL and LLLGram (taking a gram matrix)

• Maple as the function IntegerRelations[LLL]

• Mathematica as the function LatticeReduce

• Number Theory Library (NTL) as the function LLL

• PARI/GP as the function qflll

• Pymatgen as the function analysis.get_lll_reduced_lattice

• SageMath as the method LLL driven by fpLLL and NTL

• Isabelle/HOL in the 'archive of formal proofs' entry LLL_Basis_Reduction. This code exports to efficiently executable Haskell.

See also

• Coppersmith method

Notes

References