Hawk: Module LIP Makes Lattice Signatures Fast, Compact and Simple

Abstract

We propose the signature scheme Hawk, a concrete instantiation of proposals to use the Lattice Isomorphism Problem (LIP) as a foundation for cryptography that focuses on simplicity. This simplicity stems from LIP, which allows the use of lattices such as Z n , leading to signature algorithms with no floats, no rejection sampling, and compact precomputed distributions. Such design features are desirable for constrained devices, and when computing signatures inside FHE or MPC. The most significant change from recent LIP proposals is the use of module lattices, reusing algorithms and ideas from NTRUSign and Falcon. Its simplicity makes Hawk competitive. We provide cryptanalysis with experimental evidence for the design of Hawk and implement two parameter sets, Hawk-512 and Hawk-1024. Signing using Hawk-512 and Hawk-1024 is four times faster than Falcon on x86 architectures, produces signatures that are about 15% more compact, and is slightly more secure against forgeries by lattice reduction attacks. When floating-points are unavailable, Hawk signs 15 times faster than Falcon. We provide a worst case to average case reduction for module LIP. For certain parametrisations of Hawk this applies to secret key recovery and we reduce signature forgery in the random oracle model to a new problem called the one more short vector problem.

Hull Attacks on the Lattice Isomorphism Problem

“…We note that the lattices we consider, which act as a counter-example, are not necessarily a natural choice for instantiating LIP for cryptographic application, but instead they warn that the hull attack can be relevant. This is fortunately inconsequential when instantiating LIP with the trivial lattice Z n as proposed in [BGPSD21,DPPW22]…”

“…The lattice isomorphism problem (LIP) is the problem of finding an isometry between two lattices, given that such an isometry exists. It has long been a problem of interest in the geometry of numbers [PP85, PS97, Sch09, SHVvW20], in complexity theory [HR14], and has recently been proposed as a foundation for cryptography [BGPSD21,DvW22,DPPW22].…”

A Concrete LIP-Based KEM With Simple Lattices

“…Nevertheless, the authors did not conjecture that the problem of recovering rotations of Z n (ZSVP) is hard; consequently, there is no evidence of IND-CCA2 security. Finally, Ducas et al propose a concrete signature scheme called Hawk [17] based on the module variant of LIP. When compared to Falcon [19], signature generation is about 4 times faster on the x86 architecture while producing signatures that are approximately 15% smaller.…”

Kavach: Lightweight masking techniques for polynomial arithmetic in lattice-based cryptography

“…While the NIST standardization aimed at selecting a portfolio of post-quantum algorithms for general applications, there is a need for developing tailored post-quantum schemes that meet application-specific needs, for example, the constraints of the IoT and automotive applications. In recent years, several new post-quantum algorithms [DPPvW22,MKKV21] have emerged with better performance or security features (or both) than the candidate algorithms in the NIST standardization. Security against side-channel attacks [MOP07] has become an essential requirement in applications where an attacker can obtain side-channel information such as variations in the power consumption or electromagnetic emanation, or temperature of the cryptographic device.…”