# Worst-Case Complexity of the Optimal LLL Algorithm

@inproceedings{Akhavi2000WorstCaseCO, title={Worst-Case Complexity of the Optimal LLL Algorithm}, author={Ali Akhavi}, booktitle={LATIN}, year={2000} }

In this paper, we consider the open problem of the complexity of the LLL algorithm in the case when the approximation parameter of the algorithm has its extreme value 1. This case is of interest because the output is then the strongest Lovasz-reduced basis. Experiments reported by Lagarias and Odlyzko [13] seem to show that the algorithm remain polynomial in average. However no bound better than a naive exponential order one is established for the worst-case complexity of the optimal LLL…

## 16 Citations

### The optimal LLL algorithm is still polynomial in fixed dimension

- Mathematics, Computer ScienceTheor. Comput. Sci.
- 2003

### Another View of the Gaussian Algorithm

- Computer ScienceLATIN
- 2004

This work introduces here a rewrite system in the group of unimodular matrices, i.e., matrices with integer entries and with determinant equal to ± 1, to precisely characterize the mechanism of the Gaussian algorithm, that finds shortest vectors in a two–dimensional lattice given by any basis.

### The Beauty and the Beasts - The Hard Cases in LLL Reduction

- Computer ScienceIWSEC
- 2017

Experimental results show the Beasts bases derived from Beauty can withstand LLL reduction by a stable probability even for high dimensions, and the theoretical proof gives a direct explanation of this phenomenon.

### Analyzing Blockwise Lattice Algorithms Using Dynamical Systems

- Computer Science, MathematicsCRYPTO
- 2011

This work shows that BKZ can be terminated long before its completion, while still providing bases of excellent quality and develops a completely new elementary technique based on discrete-time affine dynamical systems, which could lead to the design of improved lattice reduction algorithms.

### Analyzing Blockwise Lattice Algorithms Using

- Computer Science, Mathematics
- 2011

It is shown that BKZ can be terminated long before its completion, while still providing bases of excellent quality, if given as inputs Q n×n of a lattice L and a block-size β.

### Low-dimensional lattice basis reduction revisited

- Computer ScienceTALG
- 2009

This article studies a greedy lattice basis reduction algorithm for the Euclidean norm, and shows that up to dimension four, the bit-complexity of the greedy algorithm is quadratic without fast integer arithmetic, just like Euclid's gcd algorithm.

### Chapter 1 Floating-Point LLL : Theoretical and Practical Aspects

- Computer Science
- 2009

The text-book LLL algorithm can be sped up considerably by replacing the underlying rational arithmetic used for the Gram-Schmidt orthogonalisation by floating-point approximations, so the implementer may weaken the provable variants in order to further improve their efficiency.

### Floating-Point LLL: Theoretical and Practical Aspects

- Computer ScienceThe LLL Algorithm
- 2010

The text-book LLL algorithm can be sped up considerably by replacing the underlying rational arithmetic used for the Gram–Schmidt orthogonalisation by floating-point approximations, which seems to be natural for LLL even from the theoretical point of view.

### Why 1.02? The root Hermite factor of LLL and stochastic sandpile models

- Computer ScienceArXiv
- 2018

In lattice-based cryptography, a disturbing and puzzling fact is that there exists such a conspicuous gap between the actual performance of LLL and what could be said of it theoretically. By now, no…

### Terminating BKZ

- Computer Science, MathematicsIACR Cryptol. ePrint Arch.
- 2011

This work shows that BKZ can be terminated long before its completion, while still providing bases of excellent quality and develops a completely new elementary technique based on discrete-time affine dynamical systems, which could lead to the design of improved lattice reduction algorithms.

## References

SHOWING 1-10 OF 28 REFERENCES

### The shortest vector problem in L2 is NP-hard for randomized reductions (extended abstract)

- Mathematics, Computer ScienceSTOC '98
- 1998

There is a prob-abilistic Turing-machine which in polynomial time reduces any problem in NP to instances of the shortest vector problem, provided that it can use an oracle which returns the solution of the longest vector problem if an instance of it is presented (by giving a basis of the corresponding lattice).

### Improved algorithms for integer programming and related lattice problems

- Computer Science, MathematicsSTOC
- 1983

The proposed algorithm first finds a “more orthogonal” basis for a lattice than those of Lenstra (1981) and Lenstra, Lenstra and Lovasz (1982), but in time 0(ndn poly (length of input)).

### Worst-Case Complexity Bounds for Algorithms in the Theory of Integral Quadratic Forms

- Mathematics, Computer ScienceJ. Algorithms
- 1980

### Solving low density subset sum problems

- Computer Science, Mathematics24th Annual Symposium on Foundations of Computer Science (sfcs 1983)
- 1983

This method gives a polynomial time attack on knapsack public key cryptosystems that can be expected to break them if they transmit information at rates below dc (n), as n → ∞.

### On Lovász’ lattice reduction and the nearest lattice point problem

- Mathematics, Computer ScienceComb.
- 1986

Answering a question of Vera Sós, we show how Lovász’ lattice reduction can be used to find a point of a given lattice, nearest within a factor ofcd (c = const.) to a given point in Rd. We prove that…

### The shortest vector in a lattice is hard to approximate to within some constant

- Computer ScienceProceedings 39th Annual Symposium on Foundations of Computer Science (Cat. No.98CB36280)
- 1998

It is shown the shortest vector problem in the l/sub 2/ norm is NP-hard (for randomized reductions) to approximate within any constant factor less than /spl radic/2 and an alternative construction satisfying Ajtai's probabilistic variant of Sauer's lemma is given.

### How to Break Okamoto's Cryptosystem by Reducing Lattice Bases

- Computer Science, MathematicsEUROCRYPT
- 1988

It is shown here that it can, for any odd n, solve, in polynomial probabilistic time, quadratic equations modulo n, even if the factorisation of n is hidden, provided the authors are given a sufficiently good approximation of the solutions.

### ALGORITHMIC GEOMETRY OF NUMBERS

- Mathematics, Computer Science
- 1987

The development of algorithms like the Edmonds (1965) matching algorithm and the study of the underlying polyhedral structure have gone hand in hand, each benefiting the other.

### A Hierarchy of Polynomial Time Lattice Basis Reduction Algorithms

- Computer ScienceTheor. Comput. Sci.
- 1987

### Attacking the Chor-Rivest Cryptosystem by Improved Lattice Reduction

- Computer Science, MathematicsEUROCRYPT
- 1995

Algorithms for lattice basis reduction that are improvements of the famous L3-algorithm are introduced that solve random subset sum problems of arbitrary density with 74 and 82 many weights and by breaking Damgard's hash function.