This demo shows LLL lattice reduction and toy BKZ reduction on Learning With Errors (LWE) embeddings in the browser. It focuses on the attacker workflow: reduce a basis, search for short vectors, and test whether secret recovery is possible at a chosen parameter set. The core problem illustrated is how SVP-approximation quality affects practical LWE attacks. This is a post-quantum cryptography educational model, not a production cryptanalytic tool and not evidence that LLL breaks real Kyber parameters.
- Teaching why post-quantum parameters matter in lattice cryptography. This demo makes the relationship between dimension, modulus, noise, and attack feasibility visible.
- Explaining LLL and BKZ mechanics to students or engineers. Step traces and block-improvement logs show what each reduction phase actually changes.
- Comparing toy insecure settings against Kyber-like settings. The same pipeline can be run at small and large parameters to show where attacks stop being effective.
- Demonstrating how primal LWE embeddings are constructed. The matrix and reduction output are shown directly so learners can inspect the attack surface.
- Do NOT use it for real-world security assessment. This browser implementation is intentionally simplified and does not replace specialized lattice estimators or high-performance reduction libraries.
systemslibrarian.github.io/crypto-lab-lll-break
The live app lets you step through LLL, inspect Gram-Schmidt/Lovász behavior, generate toy LWE instances, and run LLL/BKZ-based recovery attempts. It does not perform encryption/decryption; it demonstrates reduction-and-recovery attack dynamics for educational analysis. Controls include lattice dimension presets, delta, LWE parameters (n, q, sigma), and BKZ block size (beta).
- Under-parameterized LWE — a small dimension
n, small modulusq, or low noisesigmalets LLL/BKZ recover the secret quickly. Security comes from the combination of parameters, not any single knob. - Mistaking LLL for the real attack — LLL only guarantees an exponential approximation factor; real cryptanalysis uses BKZ with a large block size
beta, and cost is measured with a lattice estimator, not one LLL run. - Too little noise — if the error is tiny relative to
q, the embedded unique-shortest-vector gap is large and even weak reduction finds the secret. - Treating a browser toy as an estimator — production parameter choices need vetted tooling (the lattice estimator, sieving libraries), not a simplified in-browser reducer.
- Assuming "post-quantum" means "unbreakable" — lattice schemes are only as strong as their parameters; the lesson here is that bad parameters fall to ordinary classical reduction.
- PQC parameter selection — Kyber / ML-KEM, Dilithium / ML-DSA, and Falcon parameters are chosen so the best known BKZ attack costs at least the target security level.
- The lattice estimator — the standard tool (Albrecht et al.) models exactly this reduce-and-recover attack to price LWE and NTRU instances during standardization.
- BKZ and SVP records — progressive BKZ, BKZ 2.0, and lattice sieving (G6K) drive the Darmstadt SVP/LWE challenges that calibrate real-world attack cost.
- LLL beyond LWE — Coppersmith's method (RSA small-root and Håstad attacks), knapsack and early lattice-scheme breaks, and integer-relation detection all rely on LLL reduction.
git clone https://github.com/systemslibrarian/crypto-lab-lll-break
cd crypto-lab-lll-break
npm install
npm run dev- crypto-lab-nonce-lattice — lattice attack recovering ECDSA keys from biased nonces (the Hidden Number Problem).
- crypto-lab-lwe-hints — how side-channel "hints" weaken an LWE instance.
- crypto-lab-kyber-vault — ML-KEM (Kyber), the lattice KEM whose parameters this attack pressures.
- crypto-lab-frodo-vault — FrodoKEM, plain (unstructured) LWE for comparison.
| Exhibit | Topic | What you should be able to say afterward |
|---|---|---|
| 1 | What Is a Lattice? | Many bases generate the same lattice; the determinant is invariant under unimodular changes. Opens with a plain-language primer (lattice / basis / "many bases, one lattice") before any jargon, and the determinant label carries a hover/click tooltip: "area of one grid cell — it never changes no matter which basis you pick." |
| 2 | Gram-Schmidt | Compute b* and mu, and evaluate the Lovasz condition from them. |
| 3 | LLL Step-by-Step | Predict size-reduce / swap / advance, and see reducedBasis = U * original with det(U) = +-1 proving the lattice is unchanged. The green (current) basis is animated so you watch the vectors shrink and re-order per step. A delta vs beta callout links this exhibit's LLL knob to Exhibit 4's BKZ knob. |
| 4 | Break a Toy LWE Instance | Derive why (-s, e, +-1) is short in the primal embedding, and recover s by genuine reduction — never confusing it with the brute-force baseline. A color-coded block view of the embedding matrix (secret / error-q-ary / embed columns) animates the bottom-row-minus-sum(s_i·row_i) cancellation so the short vector visibly emerges; the norm-gap confidence meter carries a "what am I looking at" caption. |
| 5 | Parameter Explorer | Explain why tiny parameters fall to LLL/BKZ while Kyber-like dimensions push the required beta (and cost) out of reach. The n≈50 line and beta ≈ n/(2·log2(q/sigma)) formula are labelled on-screen as a rough teaching model (not a security estimate — real numbers come from the lattice estimator), with a one-line derivation tooltip for beta. |
Every canvas carries a persistent legend (red = your input basis, green = current/reduced basis, dashed cyan = Gram-Schmidt directions, dots = lattice points) so the visuals read without reverse-engineering the code.
A Reproducible Labs panel adds a seed (deterministic runs), shareable lab links, and named canonical labs; a Challenges section offers predict-then-reveal exercises.
Classroom-ready materials live in docs/:
- Glossary — every term, tied to where it appears in the app.
- Model limitations — exactly what is modeled vs. simplified; read before teaching.
- Worksheet and answer key.
- Timed labs: 30-min, 60-min, 90-min.
Part of the Crypto Lab suite.
"So whether you eat or drink or whatever you do, do it all for the glory of God." — 1 Corinthians 10:31