Lenstra–Lenstra–Lovász lattice basis reduction algorithm
   HOME

TheInfoList



OR:

The Lenstra–Lenstra–Lovász (LLL) lattice basis reduction algorithm is a
polynomial time In computer science, the time complexity is the computational complexity that describes the amount of computer time it takes to run an algorithm. Time complexity is commonly estimated by counting the number of elementary operations performed by ...
lattice reduction In mathematics, the goal of lattice basis reduction is to find a basis with short, nearly orthogonal vectors when given an integer lattice basis as input. This is realized using different algorithms, whose running time is usually at least expone ...
algorithm In mathematics and computer science, an algorithm () is a finite sequence of rigorous instructions, typically used to solve a class of specific Computational problem, problems or to perform a computation. Algorithms are used as specificat ...
invented by
Arjen Lenstra Arjen Klaas Lenstra (born 2 March 1956, in Groningen) is a Dutch mathematician, cryptographer and computational number theorist. He is currently a professor at the École Polytechnique Fédérale de Lausanne (EPFL) where he heads of the Laborator ...
,
Hendrik Lenstra Hendrik Willem Lenstra Jr. (born 16 April 1949, Zaandam) is a Dutch mathematician. Biography Lenstra received his doctorate from the University of Amsterdam in 1977 and became a professor there in 1978. In 1987 he was appointed to the faculty o ...
and
László Lovász László Lovász (; born March 9, 1948) is a Hungarian mathematician and professor emeritus at Eötvös Loránd University, best known for his work in combinatorics, for which he was awarded the 2021 Abel Prize jointly with Avi Wigderson. He wa ...
in 1982. Given a
basis Basis may refer to: Finance and accounting * Adjusted basis, the net cost of an asset after adjusting for various tax-related items *Basis point, 0.01%, often used in the context of interest rates * Basis trading, a trading strategy consisting ...
\mathbf = \ with ''n''-dimensional integer coordinates, for a
lattice Lattice may refer to: Arts and design * Latticework, an ornamental criss-crossed framework, an arrangement of crossing laths or other thin strips of material * Lattice (music), an organized grid model of pitch ratios * Lattice (pastry), an orna ...
L (a discrete subgroup of R''n'') with d \leq n , the LLL algorithm calculates an ''LLL-reduced'' (short, nearly orthogonal) lattice basis in time \mathcal O(d^5n\log^3 B) where B is the largest length of \mathbf_i under the Euclidean norm, that is, B = \max\left(\, \mathbf_1\, _2, \, \mathbf_2\, _2, \dots, \, \mathbf_d\, _2\right). The original applications were to give polynomial-time algorithms for factorizing polynomials with rational coefficients, for finding simultaneous rational approximations to real numbers, and for solving the integer linear programming problem in fixed dimensions.


LLL reduction

The precise definition of LLL-reduced is as follows: Given a
basis Basis may refer to: Finance and accounting * Adjusted basis, the net cost of an asset after adjusting for various tax-related items *Basis point, 0.01%, often used in the context of interest rates * Basis trading, a trading strategy consisting ...
\mathbf=\, define its
Gram–Schmidt process In mathematics, particularly linear algebra and numerical analysis, the Gram–Schmidt process is a method for orthonormalizing a set of vectors in an inner product space, most commonly the Euclidean space equipped with the standard inner produ ...
orthogonal basis \mathbf^*=\, and the Gram-Schmidt coefficients \mu_=\frac, for any 1 \le j < i \le n. Then the basis B is LLL-reduced if there exists a parameter \delta in such that the following holds: # (size-reduced) For 1 \leq j < i \leq n\colon \left, \mu_\\leq 0.5. By definition, this property guarantees the length reduction of the ordered basis. # (Lovász condition) For k = 2,3,..,n \colon \delta \Vert \mathbf^*_\Vert^2 \leq \Vert \mathbf^*_k\Vert^2+ \mu_^2\Vert \mathbf^*_\Vert^2. Here, estimating the value of the \delta parameter, we can conclude how well the basis is reduced. Greater values of \delta lead to stronger reductions of the basis. Initially, A. Lenstra, H. Lenstra and L. Lovász demonstrated the LLL-reduction algorithm for \delta = \frac. Note that although LLL-reduction is well-defined for \delta = 1, the polynomial-time complexity is guaranteed only for \delta in (0.25,1). The LLL algorithm computes LLL-reduced bases. There is no known efficient algorithm to compute a basis in which the basis vectors are as short as possible for lattices of dimensions greater than 4. However, an LLL-reduced basis is nearly as short as possible, in the sense that there are absolute bounds c_i > 1 such that the first basis vector is no more than c_1 times as long as a shortest vector in the lattice, the second basis vector is likewise within c_2 of the second successive minimum, and so on.


Applications

An early successful application of the LLL algorithm was its use by
Andrew Odlyzko Andrew Michael Odlyzko (Andrzej Odłyżko) (born 23 July 1949) is a Polish-American mathematician and a former head of the University of Minnesota's Digital Technology Center and of the Minnesota Supercomputing Institute. He began his career in ...
and
Herman te Riele Hermanus Johannes Joseph te Riele (born 5 January 1947) is a Dutch mathematician at CWI in Amsterdam with a specialization in computational number theory. He is known for proving the correctness of the Riemann hypothesis for the first 1.5 billio ...
in disproving
Mertens conjecture In mathematics, the Mertens conjecture is the statement that the Mertens function M(n) is bounded by \pm\sqrt. Although now disproven, it had been shown to imply the Riemann hypothesis. It was conjectured by Thomas Joannes Stieltjes, in an 1885 ...
. The LLL algorithm has found numerous other applications in
MIMO In radio, multiple-input and multiple-output, or MIMO (), is a method for multiplying the capacity of a radio link using multiple transmission and receiving antennas to exploit multipath propagation. MIMO has become an essential element of wi ...
detection algorithms and cryptanalysis of
public-key encryption Public-key cryptography, or asymmetric cryptography, is the field of cryptographic systems that use pairs of related keys. Each key pair consists of a public key and a corresponding private key. Key pairs are generated with cryptographic al ...
schemes: knapsack cryptosystems, RSA with particular settings, NTRUEncrypt, and so forth. The algorithm can be used to find integer solutions to many problems. In particular, the LLL algorithm forms a core of one of the
integer relation algorithm An integer relation between a set of real numbers ''x''1, ''x''2, ..., ''x'n'' is a set of integers ''a''1, ''a''2, ..., ''a'n'', not all 0, such that :a_1x_1 + a_2x_2 + \cdots + a_nx_n = 0.\, An integer relation algorithm is an algorithm fo ...
s. For example, if it is believed that ''r''=1.618034 is a (slightly rounded)
root In vascular plants, the roots are the organs of a plant that are modified to provide anchorage for the plant and take in water and nutrients into the plant body, which allows plants to grow taller and faster. They are most often below the sur ...
to an unknown
quadratic equation In algebra, a quadratic equation () is any equation that can be rearranged in standard form as ax^2 + bx + c = 0\,, where represents an unknown (mathematics), unknown value, and , , and represent known numbers, where . (If and then the equati ...
with integer coefficients, one may apply LLL reduction to the lattice in \mathbf^4 spanned by ,0,0,10000r^2 ,1,0,10000r and ,0,1,10000/math>. The first vector in the reduced basis will be an integer linear combination of these three, thus necessarily of the form ,b,c,10000(ar^2+br+c)/math>; but such a vector is "short" only if ''a'', ''b'', ''c'' are small and ar^2+br+c is even smaller. Thus the first three entries of this short vector are likely to be the coefficients of the integral quadratic
polynomial In mathematics, a polynomial is an expression consisting of indeterminates (also called variables) and coefficients, that involves only the operations of addition, subtraction, multiplication, and positive-integer powers of variables. An exa ...
which has ''r'' as a root. In this example the LLL algorithm finds the shortest vector to be , -1, -1, 0.00025and indeed x^2-x-1 has a root equal to the
golden ratio In mathematics, two quantities are in the golden ratio if their ratio is the same as the ratio of their sum to the larger of the two quantities. Expressed algebraically, for quantities a and b with a > b > 0, where the Greek letter phi ( ...
, 1.6180339887....


Properties of LLL-reduced basis

Let \mathbf=\ be a \delta-LLL-reduced basis of a
lattice Lattice may refer to: Arts and design * Latticework, an ornamental criss-crossed framework, an arrangement of crossing laths or other thin strips of material * Lattice (music), an organized grid model of pitch ratios * Lattice (pastry), an orna ...
\mathcal L. From the definition of LLL-reduced basis, we can derive several other useful properties about \mathbf. # The first vector in the basis cannot be much larger than the shortest non-zero vector: \Vert\mathbf_1 \Vert \le (2 / (\sqrt))^ \cdot \lambda_1(\mathcal L). In particular, for \delta = 3/4, this gives \Vert\mathbf_1 \Vert \le 2^ \cdot \lambda_1(\mathcal L). # The first vector in the basis is also bounded by the determinant of the lattice: \Vert\mathbf_1 \Vert \le (2 / (\sqrt))^ \cdot (\det(\mathcal L))^. In particular, for \delta = 3/4, this gives \Vert\mathbf_1 \Vert \le 2^ \cdot (\det(\mathcal L))^. # The product of the norms of the vectors in the basis cannot be much larger than the determinant of the lattice: let \delta = 3/4, then \prod_^n \Vert\mathbf_i \Vert \le 2^ \cdot \det(\mathcal L).


LLL algorithm pseudocode

The following description is based on , with the corrections from the errata. INPUT a lattice basis b0, b1, ..., b''n'' in Z''m'' a parameter ''δ'' with 1/4 < ''δ'' < 1, most commonly ''δ'' = 3/4 PROCEDURE B* <- GramSchmidt() = ; ''and do not normalize'' ''μ''''i'',''j'' <- InnerProduct(b''i'', b''j''*)/InnerProduct(bj*, b''j''*); ''using the most current values of'' b''i'' and b''j''* ''k'' <- 1; while ''k'' <= ''n'' do for ''j'' from ''k''−1 to 0 do if , ''μ''''k'',''j'', > 1/2 then b''k'' <- b''k'' − ⌊''μ''''k'',''j''⌉b''j''; ''Update'' B* ''and the related'' ''μ''''i'',''j'''''s as needed.'' ''(The naive method is to recompute'' B* ''whenever'' b''i'' ''changes:'' B* <- GramSchmidt() = ) end if end for if InnerProduct(b''k''*, b''k''*) > (''δ − μ2''''k'',''k''−1) InnerProduct(b''k''−1*, b''k''−1*) then ''k'' <- ''k'' + 1; else Swap b''k'' and b''k''−1; ''Update'' B* ''and the related'' ''μ''''i'',''j'''''s as needed.'' ''k'' <- max(''k''−1, 1); end if end while return B the LLL reduced basis of OUTPUT the reduced basis b0, b1, ..., b''n'' in Z''m''


Examples


Example from Z3

Let a lattice basis \mathbf_1,\mathbf_2, \mathbf_3 \in \mathbf^, be given by the columns of \begin 1 & -1& 3\\ 1 & 0 & 5\\ 1 & 2 & 6 \end then the reduced basis is \begin 0 & 1& -1\\ 1 & 0 & 0\\ 0 & 1 & 2 \end, which is size-reduced, satisfies the Lovász condition, and is hence LLL-reduced, as described above. See W. Bosma. for details of the reduction process.


Example from Z 'i''sup>4

Likewise, for the basis over the complex integers given by the columns of the matrix below, \begin -2+2i & 7+3i & 7+3i & -5+4i\\ 3+3i & -2+4i & 6+2i & -1+4i\\ 2+2i & -8+0i & -9+1i & -7+5i\\ 8+2i & -9+0i & 6+3i & -4+4i \end, then the columns of the matrix below give an LLL-reduced basis. \begin -6+3i & -2+2i & 2-2i & -3+6i \\ 6-1i & 3+3i & 5-5i & 2+1i \\ 2-2i & 2+2i & -3-1i & -5+3i \\ -2+1i & 8+2i & 7+1i & -2-4i \\ \end.


Implementations

LLL is implemented in
Arageli
as the function lll_reduction_int
fpLLL
as a stand-alone implementation *
FLINT Flint, occasionally flintstone, is a sedimentary cryptocrystalline form of the mineral quartz, categorized as the variety of chert that occurs in chalk or marly limestone. Flint was widely used historically to make stone tools and start fir ...
as the function fmpz_lll * GAP as the function LLLReducedBasis *
Macaulay2 Macaulay2 is a free computer algebra system created by Daniel Grayson (from the University of Illinois at Urbana–Champaign) and Michael Stillman (from Cornell University) for computation in commutative algebra and algebraic geometry. Overvi ...
as the function LLL in the package LLLBases *
Magma Magma () is the molten or semi-molten natural material from which all igneous rocks are formed. Magma is found beneath the surface of the Earth, and evidence of magmatism has also been discovered on other terrestrial planets and some natural sa ...
as the functions LLL and LLLGram (taking a gram matrix) *
Maple ''Acer'' () is a genus of trees and shrubs commonly known as maples. The genus is placed in the family Sapindaceae.Stevens, P. F. (2001 onwards). Angiosperm Phylogeny Website. Version 9, June 2008 nd more or less continuously updated since http ...
as the function IntegerRelations LL/code> * Mathematica as the function LatticeReduce
Number Theory Library (NTL)
as the function LLL *
PARI/GP PARI/GP is a computer algebra system with the main aim of facilitating number theory computations. Versions 2.1.0 and higher are distributed under the GNU General Public License. It runs on most common operating systems. System overview The ...
as the function qflll
Pymatgen
as the function analysis.get_lll_reduced_lattice *
SageMath SageMath (previously Sage or SAGE, "System for Algebra and Geometry Experimentation") is a computer algebra system (CAS) with features covering many aspects of mathematics, including algebra, combinatorics, graph theory, numerical analysis, numbe ...
as the method LLL driven by fpLLL and NTL *
Isabelle/HOL The Isabelle automated theorem prover is a higher-order logic (HOL) theorem prover, written in Standard ML and Scala. As an LCF-style theorem prover, it is based on a small logical core (kernel) to increase the trustworthiness of proofs with ...
in the 'archive of formal proofs' entry LLL_Basis_Reduction. This code exports to efficiently executable Haskell.


See also

*
Coppersmith method The Coppersmith method, proposed by Don Coppersmith, is a method to find small integer zeroes of univariate or bivariate polynomials modulo a given integer. The method uses the Lenstra–Lenstra–Lovász lattice basis reduction algorithm (LLL) t ...


Notes


References

* * * * * {{DEFAULTSORT:Lenstra-Lenstra-Lovasz Lattice Basis Reduction Algorithm Theory of cryptography Computational number theory Lattice points