A more efficient algorithm for lattice basis reduction

doi:10.1016/0196-6774(88)90004-1

Journal of Algorithms

Volume 9, Issue 1, March 1988, Pages 47-62

https://doi.org/10.1016/0196-6774(88)90004-1 Get rights and content

Abstract

The famous lattice basis reduction algorithm of Lovász transforms a given integer lattice basis b₁, …, b_n ϵ Zⁿ into a reduced basis, and does this by O(n⁴log B) arithmetic operations on O(n log B)-bit integers. Here B bounds the euclidean length of the input vectors, i.e., $¶b_{1} ¶^{2},…,¶b_{1} ¶^{n} ⩽ B$ . The new algorithm simulates the Lovász algorithm through approximate arithmetic. It uses at most O(n⁴log B) arithmetic operations on O(n + log B)-bit integers. For most practical cases reduction can be done without very large interger arithmetic but with floating point arithmetic instead.

References (14)

L Adleman
On breaking the iterated Merkle-Hellman public key cryptosystem
H.R.P Ferguson et al.
Generalization of the euclidean algorithm for real numbers to all dimensions higher than two
Bull. Amer. Math. Soc. (N.S.)
(1979)
A.M Frieze et al.
Linear congruential generators do not produce random sequences
J Hastad et al.
The cryptographic security of truncated linearly related variables
J Hastad et al.
Polynomial time algorithms for finding integer relations among real numbers
E Kaltofen
On the complexity of finding short vectors in integer lattices
J.C Lagarias
The computational complexity of simultaneous diophantine approximation problems

There are more references available in the full text version of this article.

Cited by (81)

An efficient lattice reduction using reuse technique blockwisely on NTRU
2016, Discrete Applied Mathematics
In this paper, we propose a lattice reduction algorithm for use with NTRU lattices. Given an NTRU lattice as its input, the algorithm computes an LLL-reduced basis. The proposed lattice reduction algorithm is more efficient than the classical LLL algorithm. Recently, a lattice reduction algorithm for ideal lattices, named iLLL, was proposed by Plantard, Susilo, and Zhang. This algorithm is identical to that of the LLL except for the fact that it contains an additional subroutine, named Reuse. The subroutine serves to further reduce a set of short vectors that has already been computed by the algorithm prior to its initiation. As a result, the iLLL is able to output an LLL-reduced basis more efficiently than the LLL is able to do so. However, the iLLL cannot be directly applied to an NTRU lattice, because it is not an ideal lattice. Yet, from the fact that an NTRU lattice is also a module lattice (a generalization of an ideal lattice), we can adapt the main idea behind the iLLL blockwisely in our approach to NTRU lattices. We demonstrate that the proposed algorithm (containing a modified version of the aforementioned subroutine Reuse) is asymptotically $\frac{n}{2}$ times faster at outputting an LLL-reduced basis than the LLL when applied to NTRU lattices of dimension $n$ . In the case of small $n$ , our experiments show that the proposed algorithm is slightly faster at outputting an LLL-reduced basis than the LLL. In addition, we present an example of how to recover a private key of an NTRU encryption scheme by using the proposed algorithm in the case of $n = 22$ .
Practical attacks on small private exponent RSA: new records and new insights
2023, Designs, Codes, and Cryptography
Post-Quantum Cryptosystems: Open Problems and Solutions. Lattice-Based Cryptosystems
2023, Journal of Applied and Industrial Mathematics
A Combination Reduction Algorithm and Its Application
2022, Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Studying lattice reduction algorithms improved by quick reordering technique
2021, International Journal of Information Security
Towards Faster Polynomial-Time Lattice Reduction
2021, Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

View all citing articles on Scopus

^∗: This research has been done at the University of Chicago, Department of Computer Science.

View full text

A more efficient algorithm for lattice basis reduction

Abstract

On breaking the iterated Merkle-Hellman public key cryptosystem

Generalization of the euclidean algorithm for real numbers to all dimensions higher than two

Bull. Amer. Math. Soc. (N.S.)

Linear congruential generators do not produce random sequences

The cryptographic security of truncated linearly related variables

Polynomial time algorithms for finding integer relations among real numbers

On the complexity of finding short vectors in integer lattices

The computational complexity of simultaneous diophantine approximation problems