New Observations on the Signature Forgery for HAWK

HAWK is a post-quantum signature scheme proposed by Ducas et al. in 2023, based on the lattice isomorphism problem. In this paper, the signature forgery of HAWK is studied. First, by analyzing the distribution of the squared norm of the secret polynomials ( f , g ) , we show that the public key 𝐐 of HAWK- n can be used to construct many valid signature pairs ( 𝐡 , s i g ) for constrained hash values. Specifically, the number of such pairs lies within [ 2 17.58 , 2 26.22 ] for HAWK-256, [ 2 29 , 2 29.22 ] for HAWK-512, and [ 2 21 , 2 21.58 ] for HAWK-1024 public keys satisfying q 00 [ 0 ] < 2 13 . Although these hash values cannot be chosen arbitrarily, this property challenges the SAMPLE-game assumption underlying the security reduction of HAWK. Second, we present a polynomial-time algorithm that solves the mLIP modulo any prime p with 2 n ∣ ( p − 1 ) . The resulting modular factorizations enable the construction of verification-equivalent bases and signatures that satisfy the modular relations used by HAWKVerify. Although the two observations do not pose a practical threat to HAWK, they provide new insights into the forgery security of HAWK.