词条 | Lenstra–Lenstra–Lovász lattice basis reduction algorithm |
释义 |
The Lenstra–Lenstra–Lovász (LLL) lattice basis reduction algorithm is a polynomial time lattice reduction algorithm invented by Arjen Lenstra, Hendrik Lenstra and László Lovász in 1982.[1] Given a basis with n-dimensional integer coordinates, for a lattice L (a discrete subgroup of Rn) with , the LLL algorithm calculates an LLL-reduced (short, nearly orthogonal) lattice basis in time where B is the largest length of under the Euclidean norm. The original applications were to give polynomial-time algorithms for factorizing polynomials with rational coefficients, for finding simultaneous rational approximations to real numbers, and for solving the integer linear programming problem in fixed dimensions. LLL reductionThe precise definition of LLL-reduced is as follows: Given a basis define its Gram–Schmidt process orthogonal basis and the Gram-Schmidt coefficients , for any . Then the basis is LLL-reduced if there exists a parameter in (0.25,1] such that the following holds:
Here, estimating the value of the parameter, we can conclude how well the basis is reduced. Greater values of lead to stronger reductions of the basis. Initially, A. Lenstra, H. Lenstra and L. Lovász demonstrated the LLL-reduction algorithm for . Note that although LLL-reduction is well-defined for , the polynomial-time complexity is guaranteed only for in . The LLL algorithm computes LLL-reduced bases. There is no known efficient algorithm to compute a basis in which the basis vectors are as short as possible for lattices of dimensions greater than 4.{{citation needed|date=August 2016}} However, an LLL-reduced basis is nearly as short as possible, in the sense that there are absolute bounds such that the first basis vector is no more than times as long as a shortest vector in the lattice, the second basis vector is likewise within of the second successive minimum, and so on. LLL algorithmThe following description is based on {{harv|Hoffstein|Pipher|Silverman|2008|loc=Theorem 6.68}}, with the corrections from the errata.[2] INPUT: a lattice basis , parameter with , most commonly PROCEDURE: Perform Gram-Schmidt, but do not normalize: {{nowrap|}} {{nowrap|'''Define''' ,}} which must always use {{nowrap|the most current values of .}} {{nowrap|'''Let''' }} {{nowrap|'''while''' '''do'''}} '''for''' {{mvar|j}} {{nowrap|'''from''' '''to''' {{math|0}} '''do'''}} {{nowrap|'''if''' '''do'''}} {{nowrap|}} Update {{mvar|ortho}} entries {{nowrap|and related 's as needed.}} {{anchor|naivemethod}}(The naive method is {{nowrap|to recompute }} {{nowrap|whenever a changes.}}) '''end if''' '''end for''' {{nowrap|'''if''' '''then'''}} {{nowrap|}} '''else''' {{nowrap|Swap and .}} Update {{mvar|ortho}} entries {{nowrap|and related 's as needed.}} (See above comment.) {{nowrap|}} '''end if''' '''end while''' OUTPUT: LLL reduced basis Properties of LLL-reduced basisLet be a -LLL-reduced basis of a lattice . From the definition of LLL-reduced basis, we can derive several other useful properties about .
ExampleThe following presents an example due to W. Bosma.[4] INPUT: Let a lattice basis , be given by the columns of Then according to the LLL algorithm we obtain the following: {{Ordered list| |For DO:{{Ordered list |For set and | }} | |Here the step 4 of the LLL algorithm is skipped as size-reduced property holds for |For and for calculate and : hence and hence and |While DO{{Ordered list |Length reduce and correct and according to reduction subroutine in step 4: For EXECUTE reduction subroutine RED(3,1): {{Ordered list |list_style_type=lower-roman| and | |Set }} For EXECUTE reduction subroutine RED(3,2): {{Ordered list |list_style_type=lower-roman| and |Set | }} |As takes place, then{{Ordered list |list_style_type=lower-roman | Exchange and | }} }} }} Apply a SWAP, continue algorithm with the lattice basis, which is given by columns Implement the algorithm steps again. {{Ordered list| | |. |. |For EXECUTE reduction subroutine RED(2,1):{{Ordered list |list_style_type=lower-roman | and |Set }} |As takes place, then |Exchange and }} OUTPUT: LLL reduced basis ApplicationsThe LLL algorithm has found numerous other applications in MIMO detection algorithms [5] and cryptanalysis of public-key encryption schemes: knapsack cryptosystems, RSA with particular settings, NTRUEncrypt, and so forth. The algorithm can be used to find integer solutions to many problems.[6] In particular, the LLL algorithm forms a core of one of the integer relation algorithms. For example, if it is believed that r=1.618034 is a (slightly rounded) root to an unknown quadratic equation with integer coefficients, one may apply LLL reduction to the lattice in spanned by and . The first vector in the reduced basis will be an integer linear combination of these three, thus necessarily of the form ; but such a vector is "short" only if a, b, c are small and is even smaller. Thus the first three entries of this short vector are likely to be the coefficients of the integral quadratic polynomial which has r as a root. In this example the LLL algorithm finds the shortest vector to be [1, -1, -1, 0.00025] and indeed has a root equal to the golden ratio, 1.6180339887…. ImplementationsLLL is implemented in
See also
Notes1. ^{{Cite journal|last1=Lenstra|first1=A. K.|author1-link=A. K. Lenstra|last2=Lenstra|first2=H. W., Jr.|author2-link=H. W. Lenstra, Jr.|last3=Lovász|first3=L.|author3-link=László Lovász|title=Factoring polynomials with rational coefficients|journal=Mathematische Annalen|volume=261|year=1982|issue=4|pages=515–534|hdl=1887/3810|doi=10.1007/BF01457454|mr=0682664}} 2. ^{{cite web|last1=Silverman|first1=Joseph|title=Introduction to Mathematical Cryptography Errata|url=http://www.math.brown.edu/~jhs/MathCrypto/MathCryptoErrata.pdf|website=Brown University Mathematics Dept.|accessdate=5 May 2015}} 3. ^{{cite web |last1=Regev |first1=Oded |title=Lattices in Computer Science: LLL Algorithm |url=https://cims.nyu.edu/~regev/teaching/lattices_fall_2004/ln/lll.pdf#page=3 |publisher=New York University |accessdate=1 February 2019}} 4. ^{{Cite web|url=http://www.math.ru.nl/~bosma/onderwijs/voorjaar07/compalg7.pdf|title=4. LLL |last=Bosma|first=Wieb|work=Lecture notes|accessdate=28 February 2010}} 5. ^Shahabuddin, Shahriar et al., "A Customized Lattice Reduction Multiprocessor for MIMO Detection", in Arxiv preprint, January 2015. 6. ^{{Cite journal|author=D. Simon |title=Selected applications of LLL in number theory |journal=LLL+25 Conference |year=2007 |place=Caen, France |url=https://simond.users.lmno.cnrs.fr/maths/lll25_Simon.pdf}} References
|title=A generalizaion of the LLL algorithm over euclidean rings or orders |journal=J. The. Nombr. Bordeaux |volume=8 |number=2 |year=1996 |pages=387–396 |url=http://www.numdam.org/item?id=JTNB_1996__8_2_387_0 }}
|volume=434 |doi=10.1016/j.laa.2010.04.003 |pages=2296–2307 }}
|ref=harv |last1=Hoffstein |first1=Jeffrey |last2=Pipher |first2=Jill |last3=Silverman |first3=J.H. |title=An Introduction to Mathematical Cryptography |year=2008 |publisher=Springer |isbn=978-0-387-77993-5 }}{{Number-theoretic algorithms}}{{Use dmy dates|date=September 2010}}{{DEFAULTSORT:Lenstra-Lenstra-Lovasz Lattice Basis Reduction Algorithm}} 3 : Theory of cryptography|Computational number theory|Lattice points |
随便看 |
|
开放百科全书收录14589846条英语、德语、日语等多语种百科知识,基本涵盖了大多数领域的百科知识,是一部内容自由、开放的电子版国际百科全书。