The LLL Lattice Reduction Algorithm

Q: What does the parameter delta actually control?

How aggressively the algorithm insists that orthogonal lengths not decrease. Larger delta means stricter conditions, better bases and more swaps. At delta = 1 the running time is no longer provably polynomial, so implementations use values slightly below 1 when quality matters.

Q: Is LLL still competitive?

As a fast preprocessing step, yes — universally. As the final reduction where quality matters, BKZ with a moderate block size has replaced it. The standard pipeline runs LLL first, then BKZ on the already-reduced basis.

Q: Can LLL handle a generating set that is not a basis?

Yes, with the dependent-vector variant, which detects linear dependencies and produces zero vectors that are then removed. This is exactly how integer kernels are computed, so the variant is not a curiosity but a working tool.

Executive summary

Polynomial time, exponential approximation, and it is enough

LLL takes any basis of a lattice and returns one that is size-reduced and satisfies the Lovász condition, in time polynomial in the dimension and the input size. The first vector of the output is guaranteed within a factor of 2^(n−1)/2 of the shortest — a weak-sounding bound that is comprehensively beaten in practice, and that turned polynomial factorisation, integer relation detection and simultaneous Diophantine approximation from research problems into library calls.

Learning objectives

State the two LLL reduction conditions and their geometric meaning.
Trace the swap-and-reduce loop and explain what each phase achieves.
Explain the potential function argument for polynomial termination.
State the quality guarantees and contrast them with observed behaviour.
Choose between standard LLL, deep insertions and BKZ.

Section 01The reduction conditions

A basis is LLL-reduced for a parameter δ with 1/4 < δ < 1 when both conditions hold.

Condition 1Size reduction: |μ_ij| ≤ 1/2

No basis vector has a large component along an earlier one. Achieved by subtracting the nearest integer multiple — a unimodular operation, so the lattice is unchanged.

Condition 2Lovász condition

‖b*_i‖² ≥ (δ − μ_i,i−1²) ‖b*_i−1‖². The orthogonal lengths may not decrease too quickly; where they do, swapping the two vectors improves the basis.

The standard choice δ = 3/4 is what appears in the original analysis; δ close to 1 gives better bases at greater cost, and the running time degrades as δ approaches 1.

Section 02The algorithm

AlgorithmLLL basis reductionin: a basis of L → out: an LLL-reduced basis of the same L

Compute the Gram–Schmidt data μ_ij and ‖b*_i‖². Set k ← 2.
Size-reduce b_k against b_k−1: subtract ⌊μ_k,k−1⌉ b_k−1. Nearest integer, hence |μ| ≤ 1/2.
If the Lovász condition fails at index k: swap b_k and b_k−1, update the Gram–Schmidt data, set k ← max(2, k−1) and return to step 2. The only step that can move backwards.
Otherwise size-reduce b_k against b_k−2, …, b₁ in that order.
Set k ← k + 1. If k ≤ n return to step 2.
Return the reduced basis.

Why it terminates in polynomial time

Define the potential D = ∏_i d_i, where d_i is the determinant of the first i basis vectors. D is a positive integer for an integer lattice, so it cannot decrease forever. Size reduction leaves D unchanged; every swap multiplies it by a factor of at most δ < 1. Hence the number of swaps is bounded by log_1/δ of the initial potential — polynomial in the input size. This argument, not the geometry, is the heart of the result.

Section 03Guarantees versus practice

For a δ-reduced basis with δ = 3/4:

‖b₁‖ ≤ 2^(n−1)/2 λ₁(L), ‖b₁‖ ≤ 2^(n−1)/4 (det L)^1/n

2^(n−1)/2worst-case approximation factor

≈ 1.02ⁿtypical observed factor on random lattices

O(n⁵ log²B)classical running time bound

The gap between theory and practice

The proven bound is exponential; observed behaviour on random lattices is far better, with the first vector typically within a small polynomial factor. Two consequences follow: LLL is far more useful than its bound suggests, and cryptographic security estimates must be based on observed behaviour, not on the worst-case guarantee.

Section 04Variants

LLL variants and when they earn their cost
Variant	Change	Effect
Deep insertion	On failure, insert b_k at the best earlier position rather than swapping with its immediate predecessor	Noticeably better bases; no polynomial time bound, but usually fast in practice
Floating-point LLL	Gram–Schmidt in floating point with exact re-verification near thresholds	The standard production choice; large constant-factor speedup
Integral LLL	All arithmetic in ℤ using scaled μ coefficients	Fully exact, slower; the reference implementation for verification
Linearly dependent input	Handles generating sets that are not bases, extracting zero vectors	Essential for integer kernel computation
BKZ	Block-wise reduction with exhaustive search inside each block	Much better bases; cost rises sharply with block size — the standard tool for cryptanalytic estimates

Do not use LLL as a shortest-vector oracle

LLL returns a short vector, not the shortest. Algorithms whose correctness depends on having the true minimum — some CM constructions and exhaustive enumeration steps — require a genuine SVP solver such as Fincke–Pohst enumeration, with LLL used only as preprocessing.

ReferenceFrequently asked questions

What does the parameter delta actually control?

How aggressively the algorithm insists that orthogonal lengths not decrease. Larger delta means stricter conditions, better bases and more swaps. At delta = 1 the running time is no longer provably polynomial, so implementations use values slightly below 1 when quality matters.

Is LLL still competitive?

As a fast preprocessing step, yes — universally. As the final reduction where quality matters, BKZ with a moderate block size has replaced it. The standard pipeline runs LLL first, then BKZ on the already-reduced basis.

Can LLL handle a generating set that is not a basis?

Yes, with the dependent-vector variant, which detects linear dependencies and produces zero vectors that are then removed. This is exactly how integer kernels are computed, so the variant is not a curiosity but a working tool.

NavigateContinue in this stream

Curated next steps from this page. The site also surfaces algorithmically related reading below.

ProvenanceSources and further reading

This page is an original KEVOS explanatory article. It presents the underlying mathematics — definitions, algorithms, complexity results and selection criteria — in KEVOS editorial voice. No text is reproduced from any copyrighted source. Where numerical tables are relevant, KEVOS links to live authoritative databases rather than republishing static values.

Handbook application: from concept to controlled practice

Purpose. This expanded section turns the original page into a practical handbook. It preserves the supplied material and adds a repeatable way to apply, check and review The LLL Lattice Reduction Algorithm. It does not replace a contract, legislation, a controlled standard, competent engineering judgement or specialist advice.

The operating aim is to turn a compact mathematical statement into a usable chain of definitions, claims, examples and checks. Read the original explanation first, then use the workflow and checks below to convert knowledge into evidence.

Treat The LLL Lattice Reduction Algorithm as a network of definitions and implications, not as a list of formulas. The working vocabulary on this page—reduction, algorithm, section, lattice, conditions—should be made explicit before any proof or computation begins. Record the ambient set or structure, the permitted operations and the equality or equivalence relation in use. A compact theorem often changes meaning when the base field, finiteness condition, commutativity assumption or direction of an action changes.

For a proof, write the hypotheses as a checklist and mark the line at which each one is used. For a computation, state the representation of the input, the arithmetic model, the termination condition and the output invariant. For a classification problem, distinguish existence from uniqueness and distinguish an object from its representation. These separations prevent a correct local calculation from being mistaken for the general result.

A useful worked example should be small enough to inspect completely but rich enough to exercise the main mechanism. Compute the result in two ways where practical: symbolically and by substitution, structurally and numerically, or directly and through a normal form. Then include one near-miss example in which a hypothesis fails. The contrast explains why the theorem is shaped as it is and gives the reader a diagnostic pattern for later problems.

Verification is part of the mathematics. Check domains and codomains, substitute proposed solutions, test identity and zero cases, compare dimensions or cardinalities, and confirm that maps respect the required operations. In numerical work, report precision, conditioning and a residual rather than digits alone. In algorithmic work, separate mathematical correctness from implementation complexity and resource limits.

Step-by-step operating method

Fix the setting. State the objects, ambient structure, notation and assumptions before manipulating symbols.
Separate claims. Distinguish definitions, hypotheses, conclusions, equivalent conditions and consequences.
Choose a method. Select proof, construction, calculation or algorithm according to the question actually asked.
Work a small case. Use the smallest non-trivial example to expose the mechanism and test edge behaviour.
Verify independently. Substitute back, check invariants, test boundary cases or use an alternative derivation.

Worked-example protocol

Illustrative method—not a source theorem. Start with a small admissible input and list the definitions it must satisfy. Carry out each transformation on a separate line, citing the property that permits it. Preserve exact values until approximation is necessary. At the end, verify the output against the original definition and one invariant such as dimension, degree, determinant, order, norm or residual. Then alter one hypothesis and observe which step ceases to be valid. This protocol creates a reusable example without inventing a theorem-specific numerical answer.

Stage	Record	Quality check
Input	Objects, domain, notation, assumptions	Every symbol is defined
Method	Permitted operation or cited result at each step	All hypotheses hold
Output	Exact result and representation	Correct type, domain and form
Verification	Substitution, invariant or alternative derivation	Independent agreement
Boundary test	Zero, identity, degenerate or failed hypothesis	Scope is understood

Common failure modes and recovery actions

1. Watch for

Using a theorem without checking every hypothesis.

Recovery: Return to the governing definition or requirement and restate the decision in one sentence.

2. Watch for

Treating a suggestive example as a proof of the general case.

Recovery: Separate evidence from assumption, assign an owner and set a date for validation.

3. Watch for

Changing notation or conventions part-way through an argument.

Recovery: Run a small counterexample, boundary test, pilot or independent check before proceeding.

4. Watch for

Hiding a division-by-zero, convergence, finiteness or commutativity assumption.

Recovery: Record the consequence, decision and rationale, then update the controlled baseline.

5. Watch for

Reporting a computed result without a residual, substitution or structural check.

Recovery: Escalate when the issue affects safety, compliance, acceptance, material value or an agreed tolerance.

Review checklist

Can every symbol be traced to a definition or prior result?
Which hypothesis does each major step use?
Does the method cover zero, identity, degenerate and boundary cases?
Can the conclusion be checked by a second representation or calculation?
Are mandatory requirements distinguished from recommendations and illustrative values?
Are sources, assumptions, units, dates and versions recorded closely enough to reproduce the decision?
Have safety, legal, ethical, stakeholder and operational consequences been considered at the appropriate level?
Is there a named owner and a trigger for review, escalation, change or retirement?

Questions for deeper application

What is the most important distinction a practitioner must preserve when applying The LLL Lattice Reduction Algorithm?