Floating-Point LLL: Theoretical and Practical Aspects

Abstract

The text-book LLL algorithm can be sped up considerably by replacing the underlying rational arithmetic used for the Gram-Schmidt orthogonalisation by floating-point approximations. We review how this modification has been and is currently implemented, both in theory and in practice. Using floating-point approximations seems to be natural for LLL even from the theoretical point of view: it is the key to reach a bit-complexity which is quadratic with respect to the bit-length of the input vectors entries, without fast integer multiplication. The latter bit-complexity strengthens the connection between LLL and Euclid's gcd algorithm. On the practical side, the LLL implementer may weaken the provable variants in order to further improve their efficiency: we emphasise on these techniques. We also consider the practical behaviour of the floating-point LLL algorithms, in particular their output distribution, their running-time and their numerical behaviour. After 25 years of implementation, many questions motivated by the practical side of LLL remain open.

Analyse numérique et réduction de réseaux

“…C'est aussi le cas où -par souci d'efficacité -la précision est volontairement limitée, et que l'on transforme un algorithme correct en heuristique. Nous nous référons par exemple aux différents modes d'exécution de L 2 (Stehlé, 2008). Cela peut être le cas aussi quand on cherche à déterminer une précision suffisante de manière dynamique, en augmentant progressivement la précision des calculs.…”

Rigorous and Efficient Short Lattice Vectors Enumeration

“…-Run the floating-point LLL algorithm with double precision for the GramSchmidt computations, with infinite loop detection (see [34]). -If the double precision seemed to suffice (i.e., the execution terminated without an infinite loop detection), compute a posteriori accuracy bounds as described by Villard in [35].…”

“…Since the possible troubles coming from the use of floating-point arithmetic are better understood, one may work around them in the cheapest valid way rather than using unnecessarily large precisions. Like LLL [34], one may hope to design combinations of reduction algorithms whose arithmetic handling is oblivious to the user, that are guaranteed and as fast as possible. A good understanding of the underlying numerical stability issues provides a firm ground to study other questions.…”

Experimental quality evaluation of lattice basis reduction methods for decorrelating low-dimensional integer least squares problems

“…As a result, even an international conference was solely dedicated to celebrate the 25th birthday of the invention of the LLL algorithm at the University of Caen in 2007, with its proceedings containing excellent review and application papers (see e.g., [6,28,29]) published in 2010 [5] (For more information on this event, the reader is referred to the conference website http://lll25.info.unicaen.fr/ and the book of proceedings [5]). …”

“…Although the LLL algorithm has been successfully applied in practice, its actual running behavior remains mysterious, is problem-dependent and cannot be precisely predicted in advance (see e.g., [6,14,29,30]), due to the fact that the swapping operation of lattice vectors is controlled by the Lovasz condition with a swapping control parameter δ (see e.g., [3,6,7,30]). Subsequent theoretical works are thus mainly focused on two aspects: (a) to understand statistical mean running behavior and average complexity of the LLL algorithm in practice and (b) to improve the efficiency and stability of the LLL algorithm.…”