Applications of the LLL Algorithm

Executive summary

The same trick, applied six ways

Every application follows one pattern: encode the desired object as a short vector in a carefully constructed lattice, where the scaling of the coordinates makes the target vector short and everything else long. Reduce the lattice; read the answer off the first basis vector. The art is entirely in the construction of the lattice and the choice of scaling factor.

Learning objectives

Construct a lattice whose short vectors encode a desired relation.
Compute integer kernels and images without coefficient explosion.
Recover a plausible minimal polynomial from a numerical approximation.
Choose a scaling factor that separates genuine relations from spurious ones.
Recognise the limits of what a numerical result can establish.

Section 01The general pattern

Stage 01EncodeExpress the sought object as an integer vector satisfying a relation.
Stage 02ScaleMultiply the coordinates carrying the relation by a large factor C, so that any vector violating the relation becomes long.
Stage 03ReduceRun LLL on the resulting lattice.
Stage 04Read and verifyExtract the candidate from the first short vector, then verify it exactly — the numerical step only proposes.

The scaling factor is the design decision

Too small, and vectors that violate the relation remain short enough to compete. Too large, and the entries become unwieldy while precision requirements balloon. The factor must exceed the size of the expected coefficients by a comfortable margin, which means the coefficient size must be estimated in advance.

Section 02Integer kernel and image

For an integer matrix A, build the lattice generated by the rows of [C·A | I]. A reduced basis vector whose left block vanishes has a right block lying in the kernel of A; the vectors whose left block survives give the image.

Why not Hermite normal form?

HNF also computes integer kernels, but its intermediate entries can explode. LLL produces a kernel basis whose vectors are short, which matters when the result feeds further computation. The usual practice is LLL first, then HNF on the reduced result — each doing what it does best.

Section 03Algebraic dependence and minimal polynomials

Given a real number α known to high precision and suspected of being algebraic of degree at most d, look for integers a₀, …, a_d, not all zero, with ∑a_iαⁱ ≈ 0.

AlgorithmRecovering a minimal polynomialin: α numerically, degree bound d → out: a candidate minimal polynomial

Compute α to N decimal digits, with N comfortably exceeding d · (expected coefficient digits).
Build the (d+1)×(d+2) matrix whose i-th row is the unit vector e_i followed by ⌊Cαⁱ⌋, with C = 10^N.
Run LLL on the rows.
Read a₀, …, a_d from the first d+1 entries of the first reduced vector. The last entry should be very small — that is the residual.
Verify exactly: confirm the polynomial is irreducible and that α is one of its roots to precision well beyond that used in the search.

A numerical relation is a conjecture, not a proof

LLL will always return something. With inadequate precision it returns a relation that holds to the digits supplied and is otherwise meaningless. Results obtained this way must be reported as conjectural unless an independent exact argument confirms them.

Section 04Further applications

Application

Simultaneous Diophantine approximation

Find one denominator q making several quantities qα_i simultaneously close to integers — the higher-dimensional analogue of a continued fraction convergent.

Application

Polynomial factorisation over ℤ

Recombine p-adic factors by finding short vectors, replacing an exponential search and yielding the first polynomial-time factorisation algorithm.

Application

Small roots of modular equations

Coppersmith's method finds roots of a modular polynomial that are small relative to the modulus — the basis of several attacks on RSA with partial key exposure.

Application

Knapsack cryptanalysis

Low-density subset-sum problems reduce to short vector problems, which broke the Merkle–Hellman cryptosystem.

Application

Ideal reduction

Find a small representative of an ideal class, making class group relation collection tractable.

Application

Number field sieve

Lattice sieving enumerates points of a sublattice within the sieving region.

ReferenceFrequently asked questions

How much precision do I need for relation detection?

As a working rule, the number of digits should exceed the degree multiplied by the expected number of digits in the coefficients, with a substantial safety margin. If a relation is found using nearly all available precision, treat it as unproven and repeat with more.

Is PSLQ better than LLL for integer relations?

PSLQ is purpose-built for relation detection and is often numerically better behaved, with clearer precision requirements. LLL is more general. For pure relation-finding, PSLQ; for problems that also need a reduced basis, LLL.

Can LLL prove a number is transcendental?

No. Failing to find a relation of degree at most d with the precision used establishes nothing — the relation may simply have higher degree or larger coefficients. The method can suggest algebraicity; it can never establish its absence.

NavigateContinue in this stream

Curated next steps from this page. The site also surfaces algorithmically related reading below.

ProvenanceSources and further reading

This page is an original KEVOS explanatory article. It presents the underlying mathematics — definitions, algorithms, complexity results and selection criteria — in KEVOS editorial voice. No text is reproduced from any copyrighted source. Where numerical tables are relevant, KEVOS links to live authoritative databases rather than republishing static values.

Handbook application: from concept to controlled practice

Purpose. This expanded section turns the original page into a practical handbook. It preserves the supplied material and adds a repeatable way to apply, check and review Applications of the LLL Algorithm. It does not replace a contract, legislation, a controlled standard, competent engineering judgement or specialist advice.

The operating aim is to turn a compact mathematical statement into a usable chain of definitions, claims, examples and checks. Read the original explanation first, then use the workflow and checks below to convert knowledge into evidence.

Treat Applications of the LLL Algorithm as a network of definitions and implications, not as a list of formulas. The working vocabulary on this page—applications, integer, section, minimal, kernel—should be made explicit before any proof or computation begins. Record the ambient set or structure, the permitted operations and the equality or equivalence relation in use. A compact theorem often changes meaning when the base field, finiteness condition, commutativity assumption or direction of an action changes.

For a proof, write the hypotheses as a checklist and mark the line at which each one is used. For a computation, state the representation of the input, the arithmetic model, the termination condition and the output invariant. For a classification problem, distinguish existence from uniqueness and distinguish an object from its representation. These separations prevent a correct local calculation from being mistaken for the general result.

A useful worked example should be small enough to inspect completely but rich enough to exercise the main mechanism. Compute the result in two ways where practical: symbolically and by substitution, structurally and numerically, or directly and through a normal form. Then include one near-miss example in which a hypothesis fails. The contrast explains why the theorem is shaped as it is and gives the reader a diagnostic pattern for later problems.

Verification is part of the mathematics. Check domains and codomains, substitute proposed solutions, test identity and zero cases, compare dimensions or cardinalities, and confirm that maps respect the required operations. In numerical work, report precision, conditioning and a residual rather than digits alone. In algorithmic work, separate mathematical correctness from implementation complexity and resource limits.

Step-by-step operating method

Fix the setting. State the objects, ambient structure, notation and assumptions before manipulating symbols.
Separate claims. Distinguish definitions, hypotheses, conclusions, equivalent conditions and consequences.
Choose a method. Select proof, construction, calculation or algorithm according to the question actually asked.
Work a small case. Use the smallest non-trivial example to expose the mechanism and test edge behaviour.
Verify independently. Substitute back, check invariants, test boundary cases or use an alternative derivation.

Worked-example protocol

Illustrative method—not a source theorem. Start with a small admissible input and list the definitions it must satisfy. Carry out each transformation on a separate line, citing the property that permits it. Preserve exact values until approximation is necessary. At the end, verify the output against the original definition and one invariant such as dimension, degree, determinant, order, norm or residual. Then alter one hypothesis and observe which step ceases to be valid. This protocol creates a reusable example without inventing a theorem-specific numerical answer.

Stage	Record	Quality check
Input	Objects, domain, notation, assumptions	Every symbol is defined
Method	Permitted operation or cited result at each step	All hypotheses hold
Output	Exact result and representation	Correct type, domain and form
Verification	Substitution, invariant or alternative derivation	Independent agreement
Boundary test	Zero, identity, degenerate or failed hypothesis	Scope is understood

Common failure modes and recovery actions

1. Watch for

Using a theorem without checking every hypothesis.

Recovery: Return to the governing definition or requirement and restate the decision in one sentence.

2. Watch for

Treating a suggestive example as a proof of the general case.

Recovery: Separate evidence from assumption, assign an owner and set a date for validation.

3. Watch for

Changing notation or conventions part-way through an argument.

Recovery: Run a small counterexample, boundary test, pilot or independent check before proceeding.

4. Watch for

Hiding a division-by-zero, convergence, finiteness or commutativity assumption.

Recovery: Record the consequence, decision and rationale, then update the controlled baseline.

5. Watch for

Reporting a computed result without a residual, substitution or structural check.

Recovery: Escalate when the issue affects safety, compliance, acceptance, material value or an agreed tolerance.

Review checklist

Can every symbol be traced to a definition or prior result?
Which hypothesis does each major step use?
Does the method cover zero, identity, degenerate and boundary cases?
Can the conclusion be checked by a second representation or calculation?
Are mandatory requirements distinguished from recommendations and illustrative values?
Are sources, assumptions, units, dates and versions recorded closely enough to reproduce the decision?
Have safety, legal, ethical, stakeholder and operational consequences been considered at the appropriate level?
Is there a named owner and a trigger for review, escalation, change or retirement?

Questions for deeper application

What is the most important distinction a practitioner must preserve when applying Applications of the LLL Algorithm?