The precise definition of LLL-reduced is as follows: Given a basis define its Gram–Schmidt processorthogonal basis and the Gram-Schmidt coefficients Then the basis is LLL-reduced if there exists a parameter in For. By definition, this property guarantees the length reduction of the ordered basis.
For k = 2,3,..,n.
Here, estimating the value of the parameter, we can conclude how well the basis is reduced. Greater values of lead to stronger reductions of the basis. Initially, A. Lenstra, H. Lenstra and L. Lovász demonstrated the LLL-reduction algorithm for. Note that although LLL-reduction is well-defined for, the polynomial-time complexity is guaranteed only for in. The LLL algorithm computes LLL-reduced bases. There is no known efficient algorithm to compute a basis in which the basis vectors are as short as possible for lattices of dimensions greater than 4. However, an LLL-reduced basis is nearly as short as possible, in the sense that there are absolute bounds such that the first basis vector is no more than times as long as a shortest vector in the lattice, the second basis vector is likewise within of the second successive minimum, and so on.
Applications
An early successful application of the LLL algorithm was its use by Andrew Odlyzko and Herman te Riele in disproving Merten's conjecture. The LLL algorithm has found numerous other applications in MIMO detection algorithms and cryptanalysis of public-key encryption schemes: knapsack cryptosystems, RSA with particular settings, NTRUEncrypt, and so forth. The algorithm can be used to find integer solutions to many problems. In particular, the LLL algorithm forms a core of one of the integer relation algorithms. For example, if it is believed that r=1.618034 is a root to an unknown quadratic equation with integer coefficients, one may apply LLL reduction to the lattice in spanned by and. The first vector in the reduced basis will be an integer linear combination of these three, thus necessarily of the form ; but such a vector is "short" only if a, b, c are small and is even smaller. Thus the first three entries of this short vector are likely to be the coefficients of the integral quadratic polynomial which has r as a root. In this example the LLL algorithm finds the shortest vector to be and indeed has a root equal tothe golden ratio, 1.6180339887....
Properties of LLL-reduced basis
Let be a -LLL-reduced basis of a lattice. From the definition of LLL-reduced basis, we can derive several other useful properties about.
The first vector in the basis cannot be much larger than the shortest non-zero vector:. In particular, for, this gives.
The first vector in the basis is also bounded by the determinant of the lattice:. In particular, for, this gives.
The product of the norms of the vectors in the basis cannot be much larger than the determinant of the lattice: let, then .
LLL algorithm pseudocode
The following description is based on, with the corrections from the errata. INPUT a lattice basis a parameter with, most commonly PROCEDURE and do not normalize using the most current values of and
while do for from to do if then
Update and the related 's as needed. end if end for if then
else Swap and Update and the related 's as needed.''
end if end while return the LLL reduced basis of OUTPUT the reduced basis
Examples
Example from
Let a lattice basis, be given by the columns of then the reduced basis is which is size-reduced, satisfies the Lovász condition, and is hence LLL-reduced, as described above. See W. Bosma. for details of the reduction process.
Example from
Likewise, for the basis over the complex integers given by the columns of the matrix below, then the columns of the matrix below give an LLL-reduced basis.
Implementations
LLL is implemented in
as the function lll_reduction_int
as a stand-alone implementation
GAP as the function LLLReducedBasis
Macaulay2 as the function LLL in the package LLLBases
