A Formalization of the LLL Basis Reduction Algorithm

Abstract

Abstract. The LLL basis reduction algorithm was the first polynomialtime algorithm to compute a reduced basis of a given lattice, and hence also a short vector in the lattice. It thereby approximates an NP-hard problem where the approximation quality solely depends on the dimension of the lattice, but not the lattice itself. The algorithm has several applications in number theory, computer algebra and cryptography.In this paper, we develop the first mechanized soundness proof of the LLL algorithm using Isabelle/HOL. We additionally integrate one application of LLL, namely a verified factorization algorithm for univariate integer polynomials which runs in polynomial time.

A Verified Efficient Implementation of the LLL Basis Reduction Algorithm

“…In this section we briefly review the existing Isabelle/HOL formalization of the LLL algorithm [5], focusing only on the process of formally verifying its correctness; for an explanation of the algorithm itself, we refer to [25] or [14].…”

“…In recent work, Divasón, Joosten, Thiemann, and Yamada [5] developed the first mechanized proof of the soundness of the LLL algorithm, using Isabelle/HOL [17]. Since Isabelle code can be exported to other programming languages and then run on actual data, their work results in a verified implementation of the LLL algorithm.…”

“…Our first contribution is to modify the verified implementation of the LLL algorithm from [5] so as to make it considerably faster. Although both the input and the output of instances of SVP are sets of integer-valued vectors, the original formalization followed a particular textbook version of the algorithm, that makes extensive use of computations on rational numbers.…”

“…Our second contribution is a formal proof of a polynomial bound on the running-time of the rational version of the algorithm from [5] (for which only the correctness, not the complexity bound, was formally proved), as well as the running time of the new integer version. We focus mainly on the latter in our presentation, but in both cases, the complexity bound is proved by first showing a polynomial bound on the number of arithmetic operations, and then showing that throughout the entire execution of the algorithm, the computed numbers can be represented using a number of bits that is polynomial in the size of the input.…”

“…The two contributions amount to a considerable expansion of the original project of [5], with the code base having roughly doubled. The new proofs are available in the Archive of Formal Proofs (AFP) for Isabelle 2018, entry LLL Basis Reduction [1].…”