{"history":[],"article":{"id":"43ade9bd-ec39-43a6-ab3a-271fdd14117b","title":"Lenstra–Lenstra–Lovász lattice basis reduction algorithm","slug":"lenstra-lenstra-lov-sz-lattice-basis-reduction-algorithm","content":":::summary\n:::\n\n# \nThe **Lenstra–Lenstra–Lovász** (**LLL**) **lattice basis reduction [algorithm](https://bliptext.com/articles/algorithm)** is a [polynomial time](https://bliptext.com/articles/polynomial-time) [lattice reduction](https://bliptext.com/articles/lattice-reduction) [algorithm](https://bliptext.com/articles/algorithm) invented by [Arjen Lenstra](https://bliptext.com/articles/arjen-lenstra), [Hendrik Lenstra](https://bliptext.com/articles/hendrik-lenstra) and [László Lovász](https://bliptext.com/articles/l-szl-lov-sz) in 1982.\nGiven a [basis](https://bliptext.com/articles/basis-linear-algebra) with n-dimensional integer coordinates, for a [lattice](https://bliptext.com/articles/lattice-group) L (a discrete subgroup of **R**n) with d \\leq n, the LLL algorithm calculates an LLL-reduced (short, nearly [orthogonal](https://bliptext.com/articles/orthogonal)) [lattice](https://bliptext.com/articles/lattice-group) [basis](https://bliptext.com/articles/basis-linear-algebra) in time where B is the largest length of under the [Euclidean norm](https://bliptext.com/articles/norm-mathematics), that is,.\nThe original applications were to give polynomial-time algorithms for [factorizing polynomials with rational coefficients](https://bliptext.com/articles/polynomial-factorization), for finding [simultaneous rational approximations to real numbers](https://bliptext.com/articles/dirichlet-s-approximation-theorem), and for solving the [integer linear programming problem](https://bliptext.com/articles/linear-programming) in fixed dimensions.\n\n# LLL reduction\nThe precise definition of LLL-reduced is as follows: Given a [basis](https://bliptext.com/articles/basis-linear-algebra)\ndefine its [Gram–Schmidt process](https://bliptext.com/articles/gram-schmidt-process) orthogonal basis\nand the Gram-Schmidt coefficients\nfor any.\nThen the basis B is LLL-reduced if there exists a parameter \\delta in such that the following holds:\nHere, estimating the value of the \\delta parameter, we can conclude how well the basis is reduced.\nGreater values of \\delta lead to stronger reductions of the basis.\nInitially, A. Lenstra, H. Lenstra and L. Lovász demonstrated the LLL-reduction algorithm for.\nNote that although LLL-reduction is well-defined for \\delta = 1, the polynomial-time complexity is guaranteed only for \\delta in (0.25,1).\nThe LLL algorithm computes LLL-reduced bases.\nThere is no known efficient algorithm to compute a basis in which the basis vectors are as short as possible for lattices of dimensions greater than 4.\nHowever, an LLL-reduced basis is nearly as short as possible, in the sense that there are absolute bounds c_i > 1 such that the first basis vector is no more than c_1 times as long as a shortest vector in the lattice,\nthe second basis vector is likewise within c_2 of the second successive minimum, and so on.\n\n# Applications\nAn early successful application of the LLL algorithm was its use by [Andrew Odlyzko](https://bliptext.com/articles/andrew-odlyzko) and [Herman te Riele](https://bliptext.com/articles/herman-te-riele) in disproving [Mertens conjecture](https://bliptext.com/articles/mertens-conjecture).\nThe LLL algorithm has found numerous other applications in [MIMO](https://bliptext.com/articles/mimo) detection algorithms and cryptanalysis of [public-key encryption](https://bliptext.com/articles/public-key-encryption) schemes: [knapsack cryptosystems](https://bliptext.com/articles/naccache-stern-knapsack-cryptosystem), [RSA](https://bliptext.com/articles/rsa-algorithm) with particular settings, [NTRUEncrypt](https://bliptext.com/articles/ntruencrypt), and so forth.\nThe algorithm can be used to find integer solutions to many problems.\nIn particular, the LLL algorithm forms a core of one of the [integer relation algorithms](https://bliptext.com/articles/integer-relation-algorithm).\nFor example, if it is believed that r=1.618034 is a (slightly rounded) [root](https://bliptext.com/articles/root-of-a-function) to an unknown [quadratic equation](https://bliptext.com/articles/quadratic-equation) with integer coefficients, one may apply LLL reduction to the lattice in spanned by and.\nThe first vector in the reduced basis will be an integer [linear combination](https://bliptext.com/articles/linear-combination) of these three, thus necessarily of the form ; but such a vector is \"short\" only if a, b, c are small and ar^2+br+c is even smaller.\nThus the first three entries of this short vector are likely to be the coefficients of the integral quadratic [polynomial](https://bliptext.com/articles/polynomial) which has r as a root.\nIn this example the LLL algorithm finds the shortest vector to be [1, -1, -1, 0.00025] and indeed x^2-x-1 has a root equal to the [golden ratio](https://bliptext.com/articles/golden-ratio), 1.6180339887....\n\n# Properties of LLL-reduced basis\nLet be a \\delta-LLL-reduced basis of a [lattice](https://bliptext.com/articles/lattice-group) \\mathcal L. From the definition of LLL-reduced basis, we can derive several other useful properties about \\mathbf{B}.\n\n# LLL algorithm pseudocode\nThe following description is based on, with the corrections from the errata.\n**INPUT**\na lattice ******b******asis ******b******1, ******b******2, ..., ******b******n in **Z**m a parameter δ with 1/4 < δ < 1, most commonly δ = 3/4\n**PROCEDURE**\n**B*** <- GramSchmidt({********b********1, ..., ********b********n}) = {********b********1*, ..., ********b********n*}; and do not normalize\nμi,j <- InnerProduct(************b************i, ************b************j*)/InnerProduct(************b************j*, ************b************j*); using the most current values of ************b************i and ************b************j* k <- 2;\n**while** k <= n **do**\n**for** j **from** k−1 **to** 1 **do**\n**if** |μk,j| > 1/2 **then**\n******b******k <- ******b******k − ⌊μk,j⌉******b******j; Update **B*** and the related μi,j 's as needed.\n(The naive method is to recompute ****B***** whenever **********b********i** changes: ****B***** <- GramSchmidt({********b********1, ..., ********b********n}) = {********b********1*, ..., ********b********n*})\n**end if**\n**end for**\n**if** InnerProduct(********b********k*, ********b********k*) > (δ − μ2k,k−1) InnerProduct(********b********k−1*, ********b********k−1*) **then**\nk <- k + 1;\n**else**\nSwap ****b****k and ****b****k−1;\nUpdate **B*** and the related μi,j 's as needed.\nk <- max(k−1, 2);\n**end if**\n**end while**\n**return** **B** the LLL reduced basis of {b1, ..., bn}\n**OUTPUT**\nthe reduced ******b******asis ******b******1, ******b******2, ..., ******b******n in **Z**m\n\n# Examples\n\n## Example from Z3\nLet a lattice basis, be given by the columns of\nthen the reduced basis is\nwhich is size-reduced, satisfies the Lovász condition, and is hence LLL-reduced, as described above.\nSee W. Bosma.\nfor details of the reduction process.\n\n## Example from Z[i]4\nLikewise, for the basis over the complex integers given by the columns of the matrix below,\nthen the columns of the matrix below give an LLL-reduced basis.\n\n# Implementations\nLLL is implemented in","current_revision":null,"created_by":"kACnuQmH5k9Nr5VNVEpVeg7XpvUmMctD","created_at":"2025-01-25T21:35:35.021Z","updated_at":"2025-01-25T21:35:35.021Z","search_vector":"'algorithm':7 'basi':5 'lattic':4 'lenstra':1,2 'lovász':3 'reduct':6","search_content":" \n \n\n# \nThe **Lenstra–Lenstra–Lovász** (**LLL**) **lattice basis reduction [algorithm](https://bliptext.com/articles/algorithm)** is a [polynomial time](https://bliptext.com/articles/polynomial-time) [lattice reduction](https://bliptext.com/articles/lattice-reduction) [algorithm](https://bliptext.com/articles/algorithm) invented by [Arjen Lenstra](https://bliptext.com/articles/arjen-lenstra), [Hendrik Lenstra](https://bliptext.com/articles/hendrik-lenstra) and [László Lovász](https://bliptext.com/articles/l-szl-lov-sz) in 1982.\nGiven a [basis](https://bliptext.com/articles/basis-linear-algebra) with n-dimensional integer coordinates, for a [lattice](https://bliptext.com/articles/lattice-group) L (a discrete subgroup of **R**n) with d \\leq n, the LLL algorithm calculates an LLL-reduced (short, nearly [orthogonal](https://bliptext.com/articles/orthogonal)) [lattice](https://bliptext.com/articles/lattice-group) [basis](https://bliptext.com/articles/basis-linear-algebra) in time where B is the largest length of under the [Euclidean norm](https://bliptext.com/articles/norm-mathematics), that is,.\nThe original applications were to give polynomial-time algorithms for [factorizing polynomials with rational coefficients](https://bliptext.com/articles/polynomial-factorization), for finding [simultaneous rational approximations to real numbers](https://bliptext.com/articles/dirichlet-s-approximation-theorem), and for solving the [integer linear programming problem](https://bliptext.com/articles/linear-programming) in fixed dimensions.\n\n# LLL reduction\nThe precise definition of LLL-reduced is as follows: Given a [basis](https://bliptext.com/articles/basis-linear-algebra)\ndefine its [Gram–Schmidt process](https://bliptext.com/articles/gram-schmidt-process) orthogonal basis\nand the Gram-Schmidt coefficients\nfor any.\nThen the basis B is LLL-reduced if there exists a parameter \\delta in such that the following holds:\nHere, estimating the value of the \\delta parameter, we can conclude how well the basis is reduced.\nGreater values of \\delta lead to stronger reductions of the basis.\nInitially, A. Lenstra, H. Lenstra and L. Lovász demonstrated the LLL-reduction algorithm for.\nNote that although LLL-reduction is well-defined for \\delta = 1, the polynomial-time complexity is guaranteed only for \\delta in (0.25,1).\nThe LLL algorithm computes LLL-reduced bases.\nThere is no known efficient algorithm to compute a basis in which the basis vectors are as short as possible for lattices of dimensions greater than 4.\nHowever, an LLL-reduced basis is nearly as short as possible, in the sense that there are absolute bounds c_i > 1 such that the first basis vector is no more than c_1 times as long as a shortest vector in the lattice,\nthe second basis vector is likewise within c_2 of the second successive minimum, and so on.\n\n# Applications\nAn early successful application of the LLL algorithm was its use by [Andrew Odlyzko](https://bliptext.com/articles/andrew-odlyzko) and [Herman te Riele](https://bliptext.com/articles/herman-te-riele) in disproving [Mertens conjecture](https://bliptext.com/articles/mertens-conjecture).\nThe LLL algorithm has found numerous other applications in [MIMO](https://bliptext.com/articles/mimo) detection algorithms and cryptanalysis of [public-key encryption](https://bliptext.com/articles/public-key-encryption) schemes: [knapsack cryptosystems](https://bliptext.com/articles/naccache-stern-knapsack-cryptosystem), [RSA](https://bliptext.com/articles/rsa-algorithm) with particular settings, [NTRUEncrypt](https://bliptext.com/articles/ntruencrypt), and so forth.\nThe algorithm can be used to find integer solutions to many problems.\nIn particular, the LLL algorithm forms a core of one of the [integer relation algorithms](https://bliptext.com/articles/integer-relation-algorithm).\nFor example, if it is believed that r=1.618034 is a (slightly rounded) [root](https://bliptext.com/articles/root-of-a-function) to an unknown [quadratic equation](https://bliptext.com/articles/quadratic-equation) with integer coefficients, one may apply LLL reduction to the lattice in spanned by and.\nThe first vector in the reduced basis will be an integer [linear combination](https://bliptext.com/articles/linear-combination) of these three, thus necessarily of the form ; but such a vector is \"short\" only if a, b, c are small and ar^2+br+c is even smaller.\nThus the first three entries of this short vector are likely to be the coefficients of the integral quadratic [polynomial](https://bliptext.com/articles/polynomial) which has r as a root.\nIn this example the LLL algorithm finds the shortest vector to be [1, -1, -1, 0.00025] and indeed x^2-x-1 has a root equal to the [golden ratio](https://bliptext.com/articles/golden-ratio), 1.6180339887....\n\n# Properties of LLL-reduced basis\nLet be a \\delta-LLL-reduced basis of a [lattice](https://bliptext.com/articles/lattice-group) \\mathcal L. From the definition of LLL-reduced basis, we can derive several other useful properties about \\mathbf{B}.\n\n# LLL algorithm pseudocode\nThe following description is based on, with the corrections from the errata.\n**INPUT**\na lattice ******b******asis ******b******1, ******b******2, ..., ******b******n in **Z**m a parameter δ with 1/4 1/2 **then**\n******b******k (δ − μ2k,k−1) InnerProduct(********b********k−1*, ********b********k−1*) **then**\nk <- k + 1;\n**else**\nSwap ****b****k and ****b****k−1;\nUpdate **B*** and the related μi,j 's as needed.\nk <- max(k−1, 2);\n**end if**\n**end while**\n**return** **B** the LLL reduced basis of {b1, ..., bn}\n**OUTPUT**\nthe reduced ******b******asis ******b******1, ******b******2, ..., ******b******n in **Z**m\n\n# Examples\n\n## Example from Z3\nLet a lattice basis, be given by the columns of\nthen the reduced basis is\nwhich is size-reduced, satisfies the Lovász condition, and is hence LLL-reduced, as described above.\nSee W. Bosma.\nfor details of the reduction process.\n\n## Example from Z[i]4\nLikewise, for the basis over the complex integers given by the columns of the matrix below,\nthen the columns of the matrix below give an LLL-reduced basis.\n\n# Implementations\nLLL is implemented in","revisionCount":0},"hasMore":false,"nextCursor":null}

History