Paper 2026/1318

Cryptanalysis of HAWK: a Guessing Game

Abstract

HAWK is a signature scheme that was introduced in 2022, and uses the lattice isomorphism problem (LIP) as a basis for post-quantum cryptography. In this work, we describe a classical algorithm that recovers the HAWK secret key in probabilistic polynomial time, assuming four number-theoretic heuristics. The reduction from the rank-2 module-LIP instances underlying HAWK to nrdPIP (Eurocrypt '25) is central to our algorithm. At a high level, we first conjugate the HAWK public Gram matrix $G$ by a random lower-triangular unimodular matrix $U$ with `short' entries, forming a new Gram matrix $G':=U^\ast GU$, and then test whether the $\mathcal{O}$-nrdPIP instance attached to $G'$ is unusually easy. In particular, for a non-negligible proportion of such instances $G'$, one can use the Lenstra-Silverberg algorithm to solve the corresponding $\mathcal{O}$-nrdPIP instance using a subfield approach. By resampling $U$ until such an instance is uncovered and solved, which can be seen as `re-randomising' the $\mathcal{O}$-nrdPIP instance whilst fixing the corresponding module-LIP instance, we are then able to recover a valid HAWK private key. At the time of writing, we do not claim that HAWK is broken, as we have not yet verified these heuristics experimentally. On the other hand, these heuristics seem to be very plausible, and we hope to be able to verify this in the future with an implementation of our algorithm. Update (30/06): Following discussions with Daniel Apon and Markku-Juhani Saarinen, we acknowledge that Heuristic 4 is insufficient to conclude that the main algorithm runs in polynomial time, and in fact the main algorithm appears to run in super-polynomial time. This mistake originates from the count of ideals of norm $q’$ in $\mathcal{O}_F$: one must include fractional ideals in this count, of which there are many. We note as an aside that Heuristics 1-3 have been independently experimentally verified. We would also like to thank the HAWK team and Alice Pellet-Mary for their responses to our work.