Lattice Basis Reduction in Infinity Norm - Technische Universität ...

4.2 LLL Algorithm
Algorithm 2.1 LLL Algorithm
Input : A basis (b1, b2, ...., bm) ∈ R n δ with 0 ≤ δ ≤ 1
1. k := 2 (k is the stage)
[Compute the Gram-Schmidt coefficient µi,j for 1 ≤ j < i < k
and ci = � ˆ bi �2 2 for i = 1, ...., k − 1]
2. WHILE k ≤ n
• IF k = 2 THEN c1 := � b1 � 2 2
• FOR j = 1, ...., k − 1
µk,j := (〈 bk,bk 〉 − � j−1
i=1 µj,iµk,ici)
cj
• ck := 〈 bk, bk 〉 − � k−1
j=1 µk,jcj
3. Reduce the size of bk
• FOR j = k − 1, ...., 1
– µ := ⌈µk,j⌋
– FOR i = 1, ...., j − 1 : µk,j := µk,i − µµj,i
– µk,j := µk,j − µ
– bk := bk − µbj
4. • IF δck−1 > ck + µ 2 k,k−1 ck−1
• THEN swap bk and bk−1 , k := max(k − 1, 2)
• ELSE k := k + 1
5. END while
OUTPUT : an LLL-reduced basis (b1, b2, ...., bm) ∈ Rn with δ
In step 1, when entering degree k, the basis (b1, b2, ...., bk−1) is already
LLL-reduced with a parameter δ and the Gram-Schmidt coefficients µi,j, for
1 ≤ j < i < k, as well as the values ci = � ˆ bi �2 2 , for i = 1, ...., k − 1,
are already available.
Step 3 is actually an algorithm that reduces the size of the basis. For
additional information on this algorithm see the lecture slides of Schnorr.
For the swap of bk and bk−1 the values � ˆ bk �2 2 , � ˆ bk−1 �2 2 and µi,j, µj,i,
for j = k − 1, k and i = 1, 2, ...., m, have to be calculated again. It is
important to keep the basis in exact arithmetics because otherwise a change
in the lattice would be made that cannot be fixed.
Let B denote max(� b1 �2 2 , � b2 �2 2 , ...., � bm �2 2 ) for the input basis.
Throughout the algorithm the bit length of the numerators and denominators
of the rational numbers � ˆ bi �2 2 , µi,j is bounded by O(m log B). The
16