Floating-Point LLL Revisited

The Lenstra-Lenstra-Lov´asz lattice basis reduction algorithm (LLL or L3 ) is a very popular tool in public-key cryptanalysis and in many other fields. Given an integer d-dimensional lattice basis with vectors of norm less than B in an n-dimensional space, L3 outputs a socalled L3 -reduced basis in polynomial time O(d5 n log3 B), using arithmetic operations on integers of bit-length O(d log B). This worst-case complexity is problematic for lattices arising in cryptanalysis where d or/and log B are often large. As a result, the original L3 is almost never used in practice. Instead, one applies floating-point variants of L3 , where the long-integer arithmetic required by Gram-Schmidt orthogonalisation (central in L3 ) is replaced by floating-point arithmetic. Unfortunately, this is known to be unstable in the worst-case: the usual floating-point L3 is not even guaranteed to terminate, and the output basis may not be L3 -reduced at all. In this article, we introduce the L2 algorithm,...

• Type: Conference
• Year: 2005
• Where: EUROCRYPT
• Authors: Phong Q. Nguyen, Damien Stehlé
• Keywords: Cryptography, EUROCRYPT 2005, Lattice Basis, Log B, Original L3