LLL and stochastic sandpile models

The LLL algorithm, despite its ubiquity and celebrity over the past 37 years, has never been properly understood so far. In this paper, we argue that LLL behaves essentially identically to a certain stochastic variant of the sandpile model that we introduce here, and that this observation explains many of its major folklore mysteries at once, in particular the well-known discrepancy between its worst- and average-case output quality. This result represents one of the first steps toward a scientific understanding of the practical behavior of lattice reduction algorithms. Its impact is most deeply felt in the area of post-quantum cryptography, in particular lattice-based cryptography, where it is of critical importance to correctly evaluate the strength of lattice reduction algorithms.