The Lenstra–Lenstra–Lovász (LLL) lattice basis reduction algorithm is a polynomial time lattice reduction algorithm invented by Arjen Lenstra, Hendrik Lenstra and László Lovász in 1982.
with n-dimensional integer coordinates, for a lattice L (a discrete subgroup of Rn) with
, the LLL algorithm calculates an LLL-reduced (short, nearly orthogonal) lattice basis in time
[2][3] The original applications were to give polynomial-time algorithms for factorizing polynomials with rational coefficients, for finding simultaneous rational approximations to real numbers, and for solving the integer linear programming problem in fixed dimensions.
The precise definition of LLL-reduced is as follows: Given a basis
define its Gram–Schmidt process orthogonal basis
is LLL-reduced if there exists a parameter
in (0.25, 1] such that the following holds: Here, estimating the value of the
parameter, we can conclude how well the basis is reduced.
lead to stronger reductions of the basis.
, the polynomial-time complexity is guaranteed only for
The LLL algorithm computes LLL-reduced bases.
There is no known efficient algorithm to compute a basis in which the basis vectors are as short as possible for lattices of dimensions greater than 4.
[4] However, an LLL-reduced basis is nearly as short as possible, in the sense that there are absolute bounds
times as long as a shortest vector in the lattice, the second basis vector is likewise within
An early successful application of the LLL algorithm was its use by Andrew Odlyzko and Herman te Riele in disproving Mertens conjecture.
[5] The LLL algorithm has found numerous other applications in MIMO detection algorithms[6] and cryptanalysis of public-key encryption schemes: knapsack cryptosystems, RSA with particular settings, NTRUEncrypt, and so forth.
The algorithm can be used to find integer solutions to many problems.
For example, if it is believed that r=1.618034 is a (slightly rounded) root to an unknown quadratic equation with integer coefficients, one may apply LLL reduction to the lattice in
The first vector in the reduced basis will be an integer linear combination of these three, thus necessarily of the form
; but such a vector is "short" only if a, b, c are small and
Thus the first three entries of this short vector are likely to be the coefficients of the integral quadratic polynomial which has r as a root.
In this example the LLL algorithm finds the shortest vector to be [1, -1, -1, 0.00025] and indeed
has a root equal to the golden ratio, 1.6180339887.... Let
From the definition of LLL-reduced basis, we can derive several other useful properties about
The following description is based on (Hoffstein, Pipher & Silverman 2008, Theorem 6.68), with the corrections from the errata.
which is size-reduced, satisfies the Lovász condition, and is hence LLL-reduced, as described above.
[10] for details of the reduction process.
Likewise, for the basis over the complex integers given by the columns of the matrix below,
then the columns of the matrix below give an LLL-reduced basis.