Kettle: Short Post-Quantum Threshold Signatures from the HAWK Signature Scheme

What it is

Kettle is a threshold (multi-party) signature protocol built from HAWK, the lattice-based signature scheme that withdrew from NIST's post-quantum competition after an AI-driven cryptanalytic attack roughly doubled its required parameter dimension. The paper argues HAWK's underlying structure remains valuable even though HAWK-the-standalone-scheme is weakened: it is unusually well-suited to multi-party computation (MPC).

How it works

HAWK signing can be decomposed into a small set of composable MPC functionalities (integer multiplication, uniform random generation, etc.). Instantiating these with MPC protocols of a given security profile (semi-honest/malicious, honest/dishonest majority) yields a threshold signing protocol with that same security profile, while still outputting standard, specification-compliant HAWK signatures. This generic compilation is what the authors call Kettle, and it scales to an arbitrary number of parties and thresholds. The authors built a proof-of-concept implementation in the MP-SPDZ framework supporting arbitrary party counts, thresholds, and security settings.

Preconditions / Affected

Relevant to teams evaluating post-quantum threshold signature schemes, particularly where lattice-based threshold signing (vs. ML-DSA/Falcon-based alternatives) is being considered. Note HAWK itself is no longer a NIST candidate due to the parameter-doubling attack — Kettle's value proposition is specifically about MPC-friendliness, not about HAWK being a standalone-secure choice at its original parameters.

What to do

Benchmarks cited: Kettle can achieve as few as 2 online rounds (about a dozen rounds total) and 2 kB of online communication per party, depending on configuration and optimization choices. It is claimed to have significantly lower round complexity and online communication cost than threshold protocols built on ML-DSA or Falcon, and "essentially the shortest signature size so far for a lattice-based threshold signature." Engineers evaluating threshold PQ signatures should weigh Kettle's communication/round numbers against ML-DSA/Falcon-based threshold schemes for their specific deployment, and review the MP-SPDZ proof-of-concept for feasibility testing.

Caveats

This is a preprint (received 2026-10-01, revised 2026-10-04) with a proof-of-concept implementation, not a production-ready library. The page does not state formal performance comparisons with specific competing threshold schemes beyond the general claims above, nor does it give concrete signature-size numbers in bytes.