HAWK
Lattices · Lattice Isomorphism · hawk-sign.info(opens in a new tab)
- Programmes
- On-ramp R3
- Latest version
- v1.1 (keygen update) ·
- Security flags
- Broken (all sets)
Parameter sets
v1.1 (keygen update) · 4 Jul 2025
| Parameter set | Level | pk (B) | sig (B) | pk+sig (B) | Sign | Verify |
|---|---|---|---|---|---|---|
| 1024 Broken | 5 | 2,440 | 1,221 | 3,661 | 29.9 µs | 47.7 µs |
| 512 Broken | 1 | 1,024 | 555 | 1,579 | 14.8 µs | 23.6 µs |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Security flags
- Broken (all parameter sets): Key-recovery reduces to SVP in dimension n/2+1 via a second Galois involution (Straznickas & Weis, Anthropic, paper), lowering key-recovery cost below the NIST level threshold for both parameter sets; the smaller HAWK-256 challenge parameter set was fully broken in practice (secret key recovered end-to-end in hours). The HAWK team withdrew the candidate from NIST's additional signature standardisation process on 2026-07-29 (pqc-forum): naïve fixes (doubling parameters or moving to higher-rank modules) make HAWK uncompetitive.
Compare versions
Parameter sets are matched by name.
| Parameter set | Level | Public key (B) | Change | Signature (B) | Change | Security flag (today's assessment) |
|---|---|---|---|---|---|---|
| 1024 | 5 | 2,440 to 2,440 | same | 1,221 to 1,221 | same | Broken. Key-recovery reduces to SVP in dimension n/2+1 via a second Galois involution (Straznickas & Weis, Anthropic, paper), lowering key-recovery cost below the NIST level threshold for both parameter sets; the smaller HAWK-256 challenge parameter set was fully broken in practice (secret key recovered end-to-end in hours). The HAWK team withdrew the candidate from NIST's additional signature standardisation process on 2026-07-29 (pqc-forum): naïve fixes (doubling parameters or moving to higher-rank modules) make HAWK uncompetitive. |
| 512 | 1 | 1,024 to 1,024 | same | 555 to 555 | same | Broken. Key-recovery reduces to SVP in dimension n/2+1 via a second Galois involution (Straznickas & Weis, Anthropic, paper), lowering key-recovery cost below the NIST level threshold for both parameter sets; the smaller HAWK-256 challenge parameter set was fully broken in practice (secret key recovered end-to-end in hours). The HAWK team withdrew the candidate from NIST's additional signature standardisation process on 2026-07-29 (pqc-forum): naïve fixes (doubling parameters or moving to higher-rank modules) make HAWK uncompetitive. |
▼ smaller or faster, ▲ larger or slower. Sizes in bytes. Flags are today's assessment of each version's parameter sets; the history below shows when each attack was published.
History
- Attack
Deterministic key-recovery attack (Straznickas & Weis, Anthropic, paper) reduces HAWK-n key recovery to poly(n) calls to an exact-SVP oracle in dimension n/2+1, using a second Galois involution (τ: ζ↦−ζ) beyond the complex conjugation prior module-LIP attacks relied on. Lowers key-recovery cost from 2^150 to 2^108 gates (HAWK-512) and from 2^288 to 2^182 gates (HAWK-1024), both below their NIST level thresholds. The smaller HAWK-256 challenge parameter set was fully broken in practice: secret key recovered end-to-end in a few hours on a single 96-core server. Falcon is unaffected. Flagged as broken.
- added to site Milestone
The HAWK team withdrew HAWK from NIST's additional signature standardisation process, citing the key-recovery attack below: naïve fixes such as doubling parameters or moving to higher-rank modules make HAWK uncompetitive with other lattice signatures. NIST confirmed the withdrawal and updated the round-3 candidates page accordingly. pqc-forum announcement.
- Milestone
NIST announced 9 Round 3 candidates for additional post-quantum signature schemes: FAEST, HAWK, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign, UOV. Rationale in NIST IR 8610. Round 3 candidates.
- New version
v1.1 (keygen update)
- New version
v1.1
- New version
v1.0