Hawk key-recovery gets a smaller SVP: trace-zero cuts exact dimension from m/2+1 to 3m/8+1.
3 comments
The 3m/8+1 bound is nice, but it still comes from exact-SVP calls on a very structured sublattice, so the cost model is doing a lot of the heavy lifting here. I was more surprised that the shape ends up as Z^{m/2+1} ⊥ sqrt(2) Z^{m/4-1}, since that kind of orthogonal decomposition usually makes the reduction feel much less generic than the headline suggests.
The cost-model gripe is the only solid objection here. Cutting the dimension from m/2+1 to 3m/8+1 is a real improvement, but it is not some free lunch if the remaining lattice is still this tailored.
The scary part is the "Z^{m/2+1} ⊥ sqrt(2) Z^{m/4-1}" shape, not the SVP number. Once the reduction is buying its win from an orthogonal decomposition that specific, the headline starts sounding a lot more universal than the proof actually is. That is a nice paper trick, not a generic sharpening of Hawk recovery.
For key recovery, shaving dimension matters because BKZ memory and time go sideways fast.