Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

Chapter 2: Mathematical Preliminaries 30
A natural question to ask in this direction is the measure of reduction using
LLL. It is also of interest to know the running time of the algorithm for practical
purpose. In this respect, we have the following result.
Lemma 2.20. Let L be an integer lattice of dimension n generated by the basis
vectors {v 1 ,v 2 ,...,v n }. Then the LLL algorithm applied on L outputs a reduced
basis of L spanned by {r 1 ,...,r n } with
||r 1 || ≤ ||r 2 || ≤ ··· ≤ ||r i || ≤ 2 n(n−1)
4(n+1−i) det(L)
1
n+1−i , for i = 1,...,n
in time polynomial in the lattice dimension n and the bitsize of the entries of the
matrix M corresponding to L.
1
2
3
4
5
6
7
8
9
10
Input: A lattice L with basis {v 1 ,v 2 ,...,v n } ∈ Z n .
Output: LLL reduced basis {r 1 ,r 2 ,...,r n } for L.
Compute v ∗ 1 ,v ∗ 2 ,...,v ∗ n ;
for i = 2 to n do
for j = i−1 to 1 do
v i = v i −[µ i,j ]v j ;
// [µ i,j ] means the integer closest to µ i,j
end
end
if ∃ i such that 3||v 4 i ∗ || 2 ≥ ||µ i+1,i v ∗ i +v ∗ i+1 || then
c = v i ;
v i = v i+1 ;
v i+1 = c;
end
go to 1;
return {r 1 ,r 2 ,...,r n } = {v 1 ,v 2 ,...,v n }.
Algorithm 6: LLL algorithm for lattice reduction.
Example 2.21. Consider the Example 2.16, where lattice L is generated by B =
{v 1 ,v 2 } with v 1 = (1,2),v 2 = (3,4). Now we discuss how Algorithm 6 works on
this basis B.
1. v ∗ 1 = v 1 = (1,2).
[ ]
2. [µ 2,1 ] = 〈v2 ,v ∗ 1 〉
||v ∗ 1
= [ 11] = 2. || 2 5
3. v 2 = (3,4)−2(1,2) = (1,0).