The Beauty and the Beasts—The Hard Cases in LLL Reduction

Alsayigh, Saed; Ding, Jíntai; Takagi, Tsuyoshi; Wang, Yuntao

doi:10.1007/978-3-319-64200-0_2

Cited by 1 publication

(3 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It is well known that LLL outputs much shorter vectors in practice. Specifically, in three to ten dimensions, it can solve an SVP with a probability of more than 99.9% by taking a factor δ close to 1 (δ > 0.999) [4].…”

Section: Lll Algorithmmentioning

confidence: 99%

“…Moreover, low-dimensional SVPs have been studied by Semaév [41] and Nguyen and Stehlé [33]; they constructed efficient lattice reduction algorithms specific to 3 or 4 dimensions, but they did not analyze the relation to the LLL algorithm. Our motivation is rather similar to Alsayigh et al's work [4]. Inspired by it, we decided to study the relationship between outputs of the LLL algorithm and shortest vectors in low dimensions.…”

Section: Introductionmentioning

confidence: 99%

“…However, it is actually much more effective in practice; it can solve exact SVPs with high probability in low dimensions. Alsayigh et al [4] found special classes of 3-dimensional lattice bases in which the LLL algorithm always/never solves the exact SVP. Moreover, low-dimensional SVPs have been studied by Semaév [41] and Nguyen and Stehlé [33]; they constructed efficient lattice reduction algorithms specific to 3 or 4 dimensions, but they did not analyze the relation to the LLL algorithm.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Explicit Relation between Low-Dimensional LLL-Reduced Bases and Shortest Vectors

Matsuda

Takayasu

Takagi

2019

IEICE Trans. Fundamentals

Self Cite

View full text Add to dashboard Cite

The Shortest Vector Problem (SVP) is one of the most important lattice problems in computer science and cryptography. The LLL lattice basis reduction algorithm runs in polynomial time and can compute an LLL-reduced basis that provably contains an approximate solution to the SVP. On the other hand, the LLL algorithm in practice tends to solve low-dimensional exact SVPs with high probability, i.e., > 99.9%. Filling this theoretical-practical gap would lead to an understanding of the computational hardness of the SVP. In this paper, we try to fill the gap in 3, 4 and 5 dimensions and obtain two results. First, we prove that given a 3, 4 or 5-dimensional LLL-reduced basis, the shortest vector is one of the basis vectors or it is a limited integer linear combination of the basis vectors. In particular, we construct explicit representations of the shortest vector by using the LLL-reduced basis. Our analysis yields a necessary and sufficient condition for checking whether the output of the LLL algorithm contains the shortest vector or not. Second, we estimate the failure probability that a 3-dimensional random LLL-reduced basis does not contain the shortest vector. The upper bound seems rather tight by comparison with a Monte Carlo simulation.

show abstract

Section: Lll Algorithmmentioning

confidence: 99%