LLL Lattice Reduction Tool
One instance per line according to the input mode: lattice -> one basis vector per line; knapsack -> a1,...,an; S; publickey -> w1,...,wn; c
Input mode:
Algorithm:
Basis output:
Iteration steps:
Calculation Result
Download CSV
| No. | Type | Vector / item | Value | Note |
|---|
Introduction to the tool and how to use it
This tool is for cryptography teaching and security research: it demonstrates why LLL lattice basis reduction works and why low-density subset-sum (knapsack) ciphers fall. Use it only for learning and authorized security testing; do not use it to attack unauthorized systems.
Enter one group per line; meaning depends on the input mode:
Precision trade-off: basis vectors are stored exactly with BigInt throughout, while Gram-Schmidt μ and ‖b*‖² use Number floating point. This keeps the implementation simple and fast, and the headroom is enough as long as a single value's bit length ≤ maxBits (default 128); over-length values trigger a clear notice.
Safeguards: dimension ≤ maxDim (default 12; LLL is O(n⁴)-scale), values ≤ maxBits bits, iterations ≤ 10000 (a clear notice instead of an endless loop when exceeded), output rows ≤ maxRows. After a knapsack attack finds a solution, it always substitutes back to verify the subset sum equals the target; if verification fails or no short vector is found, it reports recovery failed this run (density too high / dimension too large) and never falsely claims success.
Enter one group per line; meaning depends on the input mode:
lattice takes one basis vector per line (e.g. 1,1,1); knapsack writes a1,...,an; 目标和S per line (e.g. 1,3,5,11,21; 24); publickey writes the knapsack public key and ciphertext w1,...,wn; c per line.Precision trade-off: basis vectors are stored exactly with BigInt throughout, while Gram-Schmidt μ and ‖b*‖² use Number floating point. This keeps the implementation simple and fast, and the headroom is enough as long as a single value's bit length ≤ maxBits (default 128); over-length values trigger a clear notice.
Safeguards: dimension ≤ maxDim (default 12; LLL is O(n⁴)-scale), values ≤ maxBits bits, iterations ≤ 10000 (a clear notice instead of an endless loop when exceeded), output rows ≤ maxRows. After a knapsack attack finds a solution, it always substitutes back to verify the subset sum equals the target; if verification fails or no short vector is found, it reports recovery failed this run (density too high / dimension too large) and never falsely claims success.
How to use
- Per the chosen input mode, paste the matrix, subset-sum instance, or knapsack public key into the input box, one row per line.
- Choose the input mode and algorithm, and enter the δ parameter, dimension cap, and other settings.
- Click Run.
- Review the reduced basis or attack result, then copy or export.
Message board
All messages →-
No one has spoken up yet — want to go first?