Formalizing the LLL Basis Reduction Algorithm and the LLL Factorization Algorithm in Isabelle/HOL, supporting material

This is the supporting material for the paper Formalizing the LLL Basis Reduction Algorithm and the LLL Factorization Algorithm in Isabelle/HOL by René Thiemann, Ralph Bottesch, Jose Divasón, Max W. Haslbeck, Sebastiaan J. C. Joosten and Akihisa Yamada.
 

Abstract

The LLL basis reduction algorithm was the first polynomial-time algorithm to compute a reduced basis of a given lattice, and hence also a short vector in the lattice. It thereby approximates an NP-hard problem where the approximation quality solely depends on the dimension of the lattice, but not the lattice itself. The algorithm has several applications in number theory, computer algebra and cryptography.

In the paper, we provide an implementation of the LLL algorithm. Both its soundness and its polynomial running-time have been verified using Isabelle/HOL. Our implementation is nearly as fast as an implementation in a commercial computer algebra system, and its efficiency can be further increased by connecting it with fast untrusted lattice reduction algorithms whose results will be certified.

We additionally integrate one application of LLL, namely a verified factorization algorithm for univariate integer polynomials which runs in polynomial time.

Formalization

The formalization in the paper is part of the Archive of Formal Proofs via the following entries:

• A verified LLL algorithm
• A verified factorization algorithm for integer polynomials with polynomial complexity

The formalization as presented in the paper corresponds to the development version of Isabelle 23c0dfa39dce and AFP 9ed5969cb1ba. The statements presented in the paper are linked to the corresponding Isabelle ones.

Experimental Results

This archive contains the necessary material to run the experiments. It is structured as follows:

• experiments: The directory with the input lattices, a polynomial for the experiment on the factorization algorithm, the scripts, the Mathematica notebook and a standard Makefile that will compile the code and run the experiments on the input lattices.
• generated: Verified code to compute short vectors (the output will be the squared norm of a short vector) and to perform factorization of polynomials. This code has been used for the experiments.
• haskell_sources: Hand-written Haskell main-files to read integer matrix from file and execute the verified algorithm or the certified approach.
• thys: Contains the Isabelle theories to generate the code in the "generated" directory, which can be invoked with
  isabelle jedit -d $(AFP)/thys -l LLL_Basis_Reduction Basis_Reduction_Experiments.thy and with isabelle jedit -d $(AFP)/thys -l LLL_Basis_Reduction Factorization_Experiments.thy

The experiments have been conducted as follows.

• Each input lattice input_n.txt contains n vectors of dimension n. The shape of each lattice is fixed, namely it corresponds to a lattice that stems from a polynomial factorization problem. In particular, the numbers in the lattice are either 0, 1, or a n-digit random number.
• All experiments have been conducted on an iMac Pro with 3.2 GHz and 64 GB RAM running macOS 10.14.3.
• The verified Haskell code has been compiled with GHC version 8.2.1 using the -O2 parameter. Measurements are conducted using the command line tool time.
• In order to generate short vectors in Mathematica (version 11.3), we basically invoke Timing[LatticeReduce[input]] within a running Mathematica session.
• For the command line tool fplll (version 5.2.1) we again use time for measurement.
• In the verified code and fplll we set the value of the parameter α to 3/2, whereas for Mathematica we use its default settings, which appears to be undocumented. Smaller values of α lead to slightly better results.

One can rerun the experiments as follows:

1. Download and extract the attached file
2. Run the Mathematica experiments manually as explained before
3. Check that GHC and fplll are installed. Also, ensure that the numeric format of your OS is in English (the decimal separator must be a point)
4. Change into the experiments directory
5. Run the command make compile
6. Run the command make tests
7. Run the command make results.csv to generate a csv file with the required time (in seconds) for each computation and the resulting norm of the short vectors

The table displays the execution times in seconds of our experiments. Each time is linked to the corresponding output of the execution, which is a file where appears the dimension of the lattice, the required time (in seconds) and the square norm of the short vector (in that order and separated by commas).

input lattice                 verified                 Mathematica                 Certified                 fplll+certificate                 fplll       

input_10                          0.02                          0.01                               0.02                                0.01                            0.01
input_15                          0.03                          0.04                               0.03                                0.01                            0.01
input_20                          0.11                          0.10                               0.06                                0.02                            0.01
input_25                          0.27                          0.19                               0.10                                0.04                            0.02
input_30                          0.76                          0.42                               0.19                                0.08                            0.04
input_35                          1.96                          0.87                               0.36                                0.17                            0.07
input_40                          4.04                          1.65                               0.63                                0.36                            0.14
input_45                          8.64                          3.00                               1.19                                0.71                            0.24
input_50                         15.72                         4.78                               2.18                                1.42                            0.41
input_55                         30.40                         8.50                               3.73                                2.77                            0.69
input_60                         59.17                       13.93                               6.27                                4.96                            1.12
input_65                         80.99                       20.13                             10.34                               8.22                            1.61
input_70                       136.23                       31.31                             16.57                             13.78                            2.45
input_75                       274.76                       49.27                             25.36                             22.00                            3.65
input_80                       405.78                       70.83                             39.07                             34.59                            5.08
input_85                       562.25                     100.88                             61.64                             54.08                            7.01
input_90                     1160.26                     156.86                             90.92                             84.53                          10.72
input_95                     1640.19                     218.73                           135.38                          126.03                           12.67
input_100                   1624.84                     280.54                           206.34                          193.80                           15.90