Lenstra–Lenstra–Lovász lattice basis reduction algorithm
Algorithm for finding a basis of short vectors in a lattice
Top 10 Lenstra–Lenstra–Lovász lattice basis reduction algorithm related articles

Contents
The Lenstra–Lenstra–Lovász (LLL) lattice basis reduction algorithm is a polynomial time lattice reduction algorithm invented by Arjen Lenstra, Hendrik Lenstra and László Lovász in 1982.^{[1]} Given a basis $\mathbf {B} =\{\mathbf {b} _{1},\mathbf {b} _{2},\dots ,\mathbf {b} _{d}\}$
 $O(d^{5}n\log ^{3}B)\,$
where $B$
The original applications were to give polynomialtime algorithms for factorizing polynomials with rational coefficients, for finding simultaneous rational approximations to real numbers, and for solving the integer linear programming problem in fixed dimensions.
LLL reduction
The precise definition of LLLreduced is as follows: Given a basis
 $\mathbf {B} =\{\mathbf {b} _{1},\mathbf {b} _{2},\dots ,\mathbf {b} _{n}\},$
define its Gram–Schmidt process orthogonal basis
 $\mathbf {B} ^{*}=\{\mathbf {b} _{1}^{*},\mathbf {b} _{2}^{*},\dots ,\mathbf {b} _{n}^{*}\},$
and the GramSchmidt coefficients
 $\mu _{i,j}={\frac {\langle \mathbf {b} _{i},\mathbf {b} _{j}^{*}\rangle }{\langle \mathbf {b} _{j}^{*},\mathbf {b} _{j}^{*}\rangle }}$
, for any $1\leq j<i\leq n$ .
Then the basis $B$
 (sizereduced) For $1\leq j<i\leq n\colon \left\mu _{i,j}\right\leq 0.5$
. By definition, this property guarantees the length reduction of the ordered basis.  (Lovász condition) For k = 2,3,..,n $\colon \delta \Vert \mathbf {b} _{k1}^{*}\Vert ^{2}\leq \Vert \mathbf {b} _{k}^{*}\Vert ^{2}+\mu _{k,k1}^{2}\Vert \mathbf {b} _{k1}^{*}\Vert ^{2}$
.
Here, estimating the value of the $\delta$
The LLL algorithm computes LLLreduced bases. There is no known efficient algorithm to compute a basis in which the basis vectors are as short as possible for lattices of dimensions greater than 4.^{[4]} However, an LLLreduced basis is nearly as short as possible, in the sense that there are absolute bounds $c_{i}>1$
Overview of "Gram%E2%80%93Schmidt process" article
Applications
An early successful application of the LLL algorithm was its use by Andrew Odlyzko and Herman te Riele in disproving Mertens conjecture.^{[5]}
The LLL algorithm has found numerous other applications in MIMO detection algorithms^{[6]} and cryptanalysis of publickey encryption schemes: knapsack cryptosystems, RSA with particular settings, NTRUEncrypt, and so forth. The algorithm can be used to find integer solutions to many problems.^{[7]}
In particular, the LLL algorithm forms a core of one of the integer relation algorithms. For example, if it is believed that r=1.618034 is a (slightly rounded) root to an unknown quadratic equation with integer coefficients, one may apply LLL reduction to the lattice in $\mathbf {Z} ^{4}$
Lenstra–Lenstra–Lovász lattice basis reduction algorithm Applications articles: 14
Properties of LLLreduced basis
Let $\mathbf {B} =\{\mathbf {b} _{1},\mathbf {b} _{2},\dots ,\mathbf {b} _{n}\}$
 The first vector in the basis cannot be much larger than the shortest nonzero vector: $\Vert \mathbf {b} _{1}\Vert \leq (2/({\sqrt {4\delta 1}}))^{n1}\cdot \lambda _{1}({\mathcal {L}})$
. In particular, for $\delta =3/4$ , this gives $\Vert \mathbf {b} _{1}\Vert \leq 2^{(n1)/2}\cdot \lambda _{1}({\mathcal {L}})$ .^{[8]}  The first vector in the basis is also bounded by the determinant of the lattice: $\Vert \mathbf {b} _{1}\Vert \leq (2/({\sqrt {4\delta 1}}))^{(n1)/2}\cdot (\det({\mathcal {L}}))^{1/n}$
. In particular, for $\delta =3/4$ , this gives $\Vert \mathbf {b} _{1}\Vert \leq 2^{(n1)/4}\cdot (\det({\mathcal {L}}))^{1/n}$ .  The product of the norms of the vectors in the basis cannot be much larger than the determinant of the lattice: let $\delta =3/4$
, then $\prod _{i=1}^{n}\Vert \mathbf {b} _{i}\Vert \leq 2^{n(n1)/4}\cdot \det({\mathcal {L}})$ .
LLL algorithm pseudocode
The following description is based on (Hoffstein, Pipher & Silverman 2008, Theorem 6.68), with the corrections from the errata.^{[9]}
INPUT a lattice basis $\mathbf {b} _{0},\mathbf {b} _{1},\ldots ,\mathbf {b} _{n}\in \mathbb {Z} ^{m}$a parameter $\delta$ with ${\tfrac {1}{4}}<\delta <1$ , most commonly $\delta ={\tfrac {3}{4}}$ PROCEDURE $\mathbf {B^{\ast }} \gets {\rm {GramSchmidt}}(\{\mathbf {b} _{0},\ldots ,\mathbf {b} _{n}\})=\{\mathbf {b} _{0}^{\ast },\ldots ,\mathbf {b} _{n}^{\ast }\};$ and do not normalize $\mu _{i,j}\gets {\frac {\langle \mathbf {b} _{i},\mathbf {b} _{j}^{\ast }\rangle }{\langle \mathbf {b} _{j}^{\ast },\mathbf {b} _{j}^{\ast }\rangle }};$ using the most current values of $\mathbf {b} _{i}$ and $\mathbf {b} _{j}^{\ast }$ $k\gets 1;$ while $k\leq n$ do for $j$ from $k1$ to $0$ do if $\mu _{k,j}>{\tfrac {1}{2}}$ then $\mathbf {b} _{k}\gets \mathbf {b} _{k}\lfloor \mu _{k,j}\rceil \mathbf {b} _{j};$ Update $\mathbf {B^{\ast }}$ and the related $\mu _{i,j}$ 's as needed. (The naive method is to recompute $\mathbf {B^{\ast }}$ whenever $\mathbf {b} _{i}$ changes: $\mathbf {B^{\ast }} \gets {\rm {GramSchmidt}}(\{\mathbf {b} _{0},\ldots ,\mathbf {b} _{n}\})=\{\mathbf {b} _{0}^{\ast },\ldots ,\mathbf {b} _{n}^{\ast }\};$ ) end if end for if $\langle \mathbf {b} _{k}^{\ast },\mathbf {b} _{k}^{\ast }\rangle \geq \left(\delta \mu _{k,k1}^{2}\right)\langle \mathbf {b} _{k1}^{\ast },\mathbf {b} _{k1}^{\ast }\rangle$ then $k\gets k+1;$ else Swap $\mathbf {b} _{k}$ and $\mathbf {b} _{k1};$ Update $\mathbf {B^{\ast }}$ and the related $\mu _{i,j}$ 's as needed. $k\gets \max(k1,1);$ end if end while return $\mathbf {B}$ the LLL reduced basis of $\{b_{0},\ldots ,b_{n}\}$ OUTPUT the reduced basis $\mathbf {b} _{0},\mathbf {b} _{1},\ldots ,\mathbf {b} _{n}\in \mathbb {Z} ^{m}$
Examples
Example from $\mathbf {Z} ^{3}$
Let a lattice basis $\mathbf {b} _{1},\mathbf {b} _{2},\mathbf {b} _{3}\in \mathbf {Z} ^{3}$
 ${\begin{bmatrix}1&1&3\\1&0&5\\1&2&6\end{bmatrix}}$
then the reduced basis is
 ${\begin{bmatrix}0&1&1\\1&0&0\\0&1&2\end{bmatrix}}$
,
which is sizereduced, satisfies the Lovász condition, and is hence LLLreduced, as described above. See W. Bosma.^{[10]} for details of the reduction process.
Example from $\mathbf {Z} [i]^{4}$
Likewise, for the basis over the complex integers given by the columns of the matrix below,
 ${\begin{bmatrix}2+2i&7+3i&7+3i&5+4i\\3+3i&2+4i&6+2i&1+4i\\2+2i&8+0i&9+1i&7+5i\\8+2i&9+0i&6+3i&4+4i\end{bmatrix}}$
,
then the columns of the matrix below give an LLLreduced basis.
 ${\begin{bmatrix}6+3i&2+2i&22i&3+6i\\61i&3+3i&55i&2+1i\\22i&2+2i&31i&5+3i\\2+1i&8+2i&7+1i&24i\\\end{bmatrix}}$
.
Implementations
LLL is implemented in
 Arageli as the function
lll_reduction_int
 fpLLL as a standalone implementation
 GAP as the function
LLLReducedBasis
 Macaulay2 as the function
LLL
in the packageLLLBases
 Magma as the functions
LLL
andLLLGram
(taking a gram matrix)  Maple as the function
IntegerRelations[LLL]
 Mathematica as the function
LatticeReduce
 Number Theory Library (NTL) as the function
LLL
 PARI/GP as the function
qflll
 Pymatgen as the function
analysis.get_lll_reduced_lattice
 SageMath as the method
LLL
driven by fpLLL and NTL  Isabelle/HOL in the 'archive of formal proofs' entry
LLL_Basis_Reduction
. This code exports to efficiently executable Haskell.^{[11]}
Lenstra–Lenstra–Lovász lattice basis reduction algorithm Implementations articles: 6
See also
Notes
 ^ Lenstra, A. K.; Lenstra, H. W., Jr.; Lovász, L. (1982). "Factoring polynomials with rational coefficients". Mathematische Annalen. 261 (4): 515–534. CiteSeerX 10.1.1.310.318. doi:10.1007/BF01457454. hdl:1887/3810. MR 0682664.
 ^ Galbraith, Steven (2012). "chapter 17". Mathematics of Public Key Cryptography.
 ^ Nguyen, Phong Q.; Stehlè, Damien (September 2009). "An LLL Algorithm with Quadratic Complexity". SIAM J. Comput. 39 (3): 874–903. doi:10.1137/070705702. Retrieved 3 June 2019.
 ^ Nguyen, Phong Q.; Stehlé, Damien (1 October 2009). "Lowdimensional lattice basis reduction revisited". ACM Transactions on Algorithms. 5 (4): 1–48. doi:10.1145/1597036.1597050.
 ^ Odlyzko, Andrew; te Reile, Herman J. J. "Disproving Mertens Conjecture" (PDF). Journal für die reine und angewandte Mathematik. 357: 138–160. doi:10.1515/crll.1985.357.138. Retrieved 27 January 2020.
 ^ Shahabuddin, Shahriar et al., "A Customized Lattice Reduction Multiprocessor for MIMO Detection", in Arxiv preprint, January 2015.
 ^ D. Simon (2007). "Selected applications of LLL in number theory" (PDF). LLL+25 Conference. Caen, France.
 ^ Regev, Oded. "Lattices in Computer Science: LLL Algorithm" (PDF). New York University. Retrieved 1 February 2019.
 ^ Silverman, Joseph. "Introduction to Mathematical Cryptography Errata" (PDF). Brown University Mathematics Dept. Retrieved 5 May 2015.
 ^ Bosma, Wieb. "4. LLL" (PDF). Lecture notes. Retrieved 28 February 2010.
 ^ Divasón, Jose. "A Formalization of the LLL Basis Reduction Algorithm". Conference paper. Retrieved 3 May 2020.
References
 Napias, Huguette (1996). "A generalization of the LLL algorithm over euclidean rings or orders". Journal de Théorie des Nombres de Bordeaux. 8 (2): 387–396. doi:10.5802/jtnb.176.
 Cohen, Henri (2000). A course in computational algebraic number theory. GTM. 138. Springer. ISBN 3540556400.CS1 maint: ref=harv (link)
 Borwein, Peter (2002). Computational Excursions in Analysis and Number Theory. ISBN 0387954449.
 Luk, Franklin T.; Qiao, Sanzheng (2011). "A pivoted LLL algorithm". Linear Algebra and Its Applications. 434 (11): 2296–2307. doi:10.1016/j.laa.2010.04.003.
 Hoffstein, Jeffrey; Pipher, Jill; Silverman, J.H. (2008). An Introduction to Mathematical Cryptography. Springer. ISBN 9780387779935.CS1 maint: ref=harv (link)