This text was not written by me. It’s a direct copy/paste of a Claude summary of the attack, intended for general audiences, and (as with all AI explanations) it could contain errors. You can ask Claude for a better explanation if you want.

The nature of the HAWK attack

A recently published attack significantly weakened HAWK, a candidate for a future post-quantum signature standard. The natural question to ask about it — did they attack the underlying math problem, or did they attack the scheme built on top of it? — has a surprising answer, and seeing why is the whole key to understanding what actually happened. For HAWK, those two things turn out to be one and the same.

Start with the puzzle HAWK rests on. HAWK is a digital signature scheme, the kind of cryptography your browser uses to confirm a website really is who it claims to be. Its security rests on a hard problem about lattices. A lattice is just an endlessly repeating grid of points — picture the corners of a tiled floor, but in hundreds of dimensions instead of two. The same grid can be written down in many different coordinate systems: some descriptions are “tidy” (short, clean directions for navigating the grid) and others are deliberately “scrambled” (long, messy directions that trace out the exact same points). Going from tidy to scrambled is easy; going back the other way — recovering a tidy description when you’ve only been handed a scrambled one — is believed to be enormously hard. That gap is the Lattice Isomorphism Problem, or LIP. HAWK’s secret key is a tidy description of a grid; its public key is a scrambled description of the same grid. The “search” in search-LIP, or smLIP, just means you have to actually produce a tidy description, not merely confirm that one exists. And the “module” part means HAWK uses a specially structured, algebra-rich flavor of the puzzle — chosen because that structure is exactly what lets HAWK’s keys be small and its signing fast. Hold onto that last point; it comes back at the end.

Now, why “problem versus scheme” collapses. For HAWK, recovering the secret key is identical to solving its particular lattice puzzle — not merely similar, not reducible-with-some-loss, but literally the same task. Anyone who can produce a tidy description of the public grid can sign messages as though they were the real key-holder. So there is no daylight between “solve the math problem for this key” and “break this key.” The attack does exactly the former and hands back a forged signing key that HAWK’s own verifier accepts. This is important: it means the attack isn’t sidestepping the hard problem through some coding flaw or side channel. It is a genuine solution to the hard problem, for these particular instances.

But — and this is the crucial distinction — solving these instances is not the same as showing the general problem is easy. HAWK didn’t fall because the Lattice Isomorphism Problem turned out to be weak. It fell because the specific puzzles HAWK generates carry a hidden shortcut that generic puzzles of the same type don’t have.

Here’s how that shortcut relates to HAWK’s guarantees, because this is the part people usually get backwards. Like every serious modern scheme, HAWK came with a mathematical proof of the form “if an attacker could forge signatures, then that attacker could solve the underlying puzzle.” That proof is correct, and the attack did not find a loophole in it. Instead, the attack went underneath it: rather than hunting for a clever forgery, it simply solved the puzzle directly — the very thing the proof had been leaning on as the hard, load-bearing floor. The guarantee held perfectly. It just turned out to be resting on a floor that was lower than everyone believed.

And that’s where the real looseness lived — not in the proof, but in the estimate of how hard the puzzle is. To choose key sizes, HAWK’s designers estimated the cost of the best possible attack on their puzzle and set the parameters so that cost would be astronomical. Their estimate assumed the best technique known at the time. The new attack is a better technique: it cuts HAWK’s effective key strength roughly in half, which means the real security is far below the advertised level. To win it back, you’d have to roughly double the key sizes — which erases the compactness that made HAWK attractive to begin with.

What was the shortcut? Without the machinery: the particular number system HAWK is built on has an extra internal symmetry — a way the puzzle secretly folds onto itself — that most versions of this problem lack. Other researchers had already shown, a little earlier, that if a puzzle has this kind of symmetry and you can find it, the puzzle becomes dramatically easier to solve. What nobody had settled was whether HAWK’s puzzles actually contain a usable one. This attack’s contribution was to show that they do, and to find it. The symmetry isn’t a bug in anyone’s code; it’s a consequence of a deliberate mathematical design choice.

Which is precisely why the foundation survives intact. The attack is provably specific to that design choice: alter the underlying number system in a certain way and the symmetry — and the entire attack — simply vanishes. Falcon, HAWK’s close cousin and a scheme actually heading toward deployment, is built differently and is completely immune. And the general Lattice Isomorphism Problem, the abstract foundation, is untouched. What broke was not “lattice cryptography,” and not even “LIP,” but HAWK’s specific choice of how to instantiate it.

If this pattern sounds familiar, it should — it is essentially what happened to SIKE, a different post-quantum candidate that was spectacularly broken in 2022. There too, the scheme rested on a problem that looked solidly hard, with a tight link between “break the scheme” and “solve the problem.” And there too, the downfall was hidden structure in the specific instances the scheme published, not any weakness in the general problem, which remains standing today. A security proof only ever certifies “breaking my scheme is at least as hard as solving my puzzles.” It says nothing about whether your puzzles happen to be secretly easy. Discovering that is what cryptanalysis is for, and it’s the whole reason candidate schemes are put through years of public attack before anyone dares deploy them.

The final irony ties it all together: the structured, algebra-rich number system HAWK chose — the very thing that made its keys small and its signatures fast, its entire selling point — is the same structure that carried the hidden symmetry the attack exploited. The feature and the vulnerability were one and the same decision.