HAWK-n Key Recovery Reduces to SVP in Dimension n/2 + 1

[Steve Weis]

Hello pqc-forum. We would like to announce an improved key recovery attack against HAWK-n that reduces to SVP in dimension n/2 + 1. The paper will appear at https://anthropic.com/document/hawk_key_recovery.pdf and is linked to from an accompanying blog post that will shortly be live: https://www.anthropic.com/research/discovering-cryptographic-weaknesses

In the gate-count model of AGPS'20, the improved attack lowers the key-recovery cost of HAWK-512 from 2^150 to 2^108 and of HAWK-1024 from 2^288 to 2^182. We demonstrate this with a practical implementation that recovers a HAWK-256 secret key end-to-end in a few hours on a single server. The implementation can be found at: https://github.com/anthropics/cryptography-research-demo

This result does not impact Falcon, ML-DSA, or other latticed-based schemes.

We would like to thank the HAWK team for their help verifying this result and for their feedback. We would also like to acknowledge that this was found by Claude, with minimal technical guidance from people. For more information on the process, please refer to the above blog post.

Thank you very much.

[Daniel Apon]

Nice.

It checks out independently for me.

[Hengyi Luo]

Thank you for your sharing—this is really a surprising work. We would also like to share a related piece of work produced by GPT-5.6 with only minimal technical guidance from human researchers, which  attacks HAWK by solving SVP with dimension (3n/4). Although the result is weaker than that of the work above, the approach is different, which may still offer some additional conceptual insight.
We implemented it using Codex and shared the results with the HAWK team, who are currently carrying out their own verification. See more details in
https://harylo.github.io/files/preprints/adjoint-lattice-reduction-for-the-hawk-gram-factor-problem.pdf


We subsequently investigated the geometric idea behind  this attack  and generalize it to rank (4) with the help of GPT. In that setting, an (R^4)-mLIP instance can be reduced to SVP in dimension (3n/2), improving upon the generic approach of treating it directly as a  (\mathbb{Z})-LIP instance with rank (4n).  A draft describing this extension is available here:

https://harylo.github.io/files/preprints/linear-descent-for-rank-2-and-rank-4-module-lip.pdf

[Daniel Apon]

Anonymous research draft 17 July 2026  

Also nice

--
You received this message because you are subscribed to the Google Groups "pqc-forum" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pqc-forum+...@list.nist.gov.
To view this discussion visit https://groups.google.com/a/list.nist.gov/d/msgid/pqc-forum/20febba1-2c24-4da4-a46e-100b66cfdf47n%40list.nist.gov.

[Markku-Juhani O. Saarinen]

Hi All,

Cool stuff.

Not targeted at anyone in particular -- some thoughts and a totally tangential AI cryptanalysis research note.

First, I would encourage practitioners of AI-assisted cryptanalysis always to provide tangible evidence, such as machine-checkable proofs or successful attack demonstrations against scaled-down versions of targets (like Anthropic did). Anything that makes independent validation easier.

Just as AI helps significantly increase code quality & security if used right (more tests, rigorous formal models, etc.), it can also increase positive assurance of (surviving) crypto algorithms themselves: better proofs, research depth, etc. For example, I'd think that expectation in near future is that more complex security proofs and arguments are machine-checkable. Some additional groundwork may be needed for that with Lean and other tools, though.

ps. Here are some (as far as I know) new McEliece structural key recovery records, including a break of TII-252: https://github.com/mjosaarinen/tii-solved

These were solved with HOVER, a new AI-extended version of the Hemmert-Wiemers HOV attack (Crypto 2026).

Cheers,

-markku

Dr. Markku-Juhani O. Saarinen <mj...@iki.fi>

--

[Demi Marie Obenour]

If one mitigates this attack by increasing parameters, does HAWK
still have advantages over other signature algorithms?
--
Sincerely,
Demi Marie Obenour (she/her/hers)

[Minseop Choi]

Anthropic's post states the following: "The automorphism discovered by Mythos allows a faster enumeration attack that, while still exponential, means that one needs to double the size of HAWK keys to achieve the same level of security. Unfortunately, doubling HAWK's key size eliminates many of the reasons making the scheme (as it currently stands) an attractive PQC signature candidate."

2026년 7월 29일 수요일 오전 9시 25분 37초 UTC+9에 Demi Marie Obenour님이 작성:

[Daniel Apon]

Hi markku & all--

I'd actually like to generally agree with markku here, but also take this moment to especially highlight that we are in need of a community-driven "Ten Commandments" for how to adjudicate AI-generated cryptanalytic claims.

For motivation's sake, consider Scott Aaronson's (historical, highly revered, and.. yikes, now-quaint :)) position on "Ten Signs a Claimed Mathematical Breakthrough is Wrong."
https://scottaaronson.blog/?p=304

Let's take this specific example as a serious point of comparison:

With Anthropic's work, we have not only a paper and a claim, but:
i) A clearly written paper. Admittedly there is a lot of new AI-generated mathematical content, but some effort (in my opinion: more effort) has been put into making it digestible.
i.b) Not a variety of 'short drafts' strung together, but something prepared with care for public release.
ii) A process for release that involved interacting with multiple experts for human-review before claiming a major breakthrough.
iii) A scientifically-reproducible set of open-source code that can be audited and run, even adapted to various toy problems.

I'm sure there are a great deal more "Commandments" that can be clearly stated and agreed upon, but I suppose my main thought at the moment is: Unless we take time to articulate what good scientific process is for using AI in public cryptanalysis and evaluating its outputs, we humans will get quickly overwhelmed by too much AI-driven mathematical content/claims to reach consensus on any topic. (And let's be honest-- we can't very well sit here running our own AI verifiers on every possible claim; no central place will easily afford the token count.)

(This all assumes one can't get away from AI-driven cryptanalysis. But clearly we've walked through that door today. No turning back now.)

Kind regards,
--Daniel

To view this discussion visit https://groups.google.com/a/list.nist.gov/d/msgid/pqc-forum/CA%2BiU_qkmoy_K0u0FeMT-YAO6kihGpey4OgKN0nvaiiP29zQhdg%40mail.gmail.com.

[Bas Westerbaan]

HAWK wasn't really looking great to start with because of the missing middle security level. HAWK-1024 basically has the same combined public key+signature size as ML-DSA-44. Of course the signature alone is half the size. That's not that appealing anymore. Even worse, this assumes HAWK-1024 has a good margin above 128-bits, which seems unlikely. If it doesn't have the margin, then we're looking at even larger signatures and keys, and any advantage over ML-DSA-44 has evaporated.

 

--
Sincerely,
Demi Marie Obenour (she/her/hers)

--
You received this message because you are subscribed to the Google Groups "pqc-forum" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pqc-forum+...@list.nist.gov.

To view this discussion visit https://groups.google.com/a/list.nist.gov/d/msgid/pqc-forum/fe52296c-2366-484e-8ccb-b30ec32eaf56%40gmail.com.

[Leo Ducas]

 Dear Steve and pqc-forum,

We would like to thank Anthropic for their contribution to the cryptanalysis of HAWK, and for communicating with us throughout.
We confirm that their attack approximately halves the block size required in lattice reduction to recover (an equivalent) secret key.
Naïve approaches to circumvent this, such as doubling parameters or moving to higher rank modules, make HAWK uncompetitive.
As such, we withdraw our candidate HAWK from NIST's ongoing additional signature scheme standardisation process.

Good luck to all the remaining candidates.
The HAWK team would like to thank everyone who has attacked, contributed to or discussed HAWK since the it's publication in 2022.

-- the HAWK team

[Manuel Barbosa]

Dear all,

My first contribution to this forum to concur with the observations made in the thread and make the obvious point that machine-checked proofs can help, but the infrastructure underneath (the TCB), any assumptions made by the proofs (the leaves in the proof tree) and the actual semantics of claims will still need to be human-checkable.

Manuel

> To view this discussion visit https://groups.google.com/a/list.nist.gov/d/msgid/pqc-forum/CAPxHsSKnQkecrQzY1oFkUJP8J-hFYFR%2Br7Vxn39-w7cKwJ6OMA%40mail.gmail.com.

[dustin...@nist.gov]

All,

NIST would like to thank the HAWK team for all the work they've done on their submission throughout the process.  We have updated our Round 3 page for the onramp to indicate that HAWK has been withdrawn:

https://csrc.nist.gov/Projects/pqc-dig-sig/round-3-additional-signatures

Dustin Moody

NIST PQC

[Cong Ling]

Dear Colleagues,

This is a historic moment in cryptology: AI has beaten humans at cryptanalysis. We would like to share a few thoughts with the PQC community based on our own experience.

There are other dimension-reduction attacks on HAWK in literature. At Eurocrypt 2026, we proposed a dimension-halving algorithm for quaternion Ideal-SVP, which potentially implies that HAWK-n key recovery can be reduced to (cyclotomic) Ideal-SVP in dimension n:

https://eprint.iacr.org/2025/1448

Later, we proposed another guessing attack based on advanced number theory, under a few heuristic assumptions:

https://eprint.iacr.org/2026/1318

However, one of these heuristics was soon found to be invalid by colleagues with the assistance of AI.

Apparently, we were outpaced by AI in both cases. A couple of lessons we have learned are: (a) humans can make mistakes; and (b) humans are slower than AI. Beyond cryptanalysis itself, the use of AI to check mathematical proofs is becoming an increasingly serious issue.

One can even imagine a crisis in cryptography: in the worst-case scenario, all human-designed cryptosystems are broken by AI. Whether or not that happens, a new era—Post-AI Cryptography—has arrived.

Cong Ling

[Daniel Apon]

Will the SQIsign Team now withdraw their candidate from the process on similar grounds because of https://eprint.iacr.org/2026/1486.pdf?

[Watson Ladd]

On Thu, Jul 30, 2026, 5:12 PM Daniel Apon <dapon....@gmail.com> wrote:

Will the SQIsign Team now withdraw their candidate from the process on similar grounds because of https://eprint.iacr.org/2026/1486.pdf?

The paper intro explains that it uses significant memory. That reduces the relevance.

The reason HAWK got withdrawn is halving the dimension makes it no longer completive with existing signatures based on lattices. SQISign doesn't have that problem. 

--

You received this message because you are subscribed to the Google Groups "pqc-forum" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pqc-forum+...@list.nist.gov.

To view this discussion visit https://groups.google.com/a/list.nist.gov/d/msgid/pqc-forum/275cd2b0-becb-45e4-83cf-beac6be59dadn%40list.nist.gov.

[Natalia]

Cong, 

I agree with you. I was a bit blown away by the news, but I hate to say that I'm not surprised. Maybe we need a path forward that is not so linear or multiple paths. We can't think like we did before. We need more 4D and 5D thinking. 

This loss is unexpected. Thank you Hawk for your contributions. 

Natalia D'Onofrio, FRP, MBA

Affinity Ventures, LLC  |  Founder

P.O. Box 2059

Palm Beach, FL 33480

Tel: (561) 501-1033

 

--

You received this message because you are subscribed to the Google Groups "pqc-forum" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pqc-forum+...@list.nist.gov.

To view this discussion visit https://groups.google.com/a/list.nist.gov/d/msgid/pqc-forum/85aedddd-2446-4f03-bdc6-34d6149f70fcn%40list.nist.gov.

[Shahapure, Shravani]

I agree Cong !

 

Best Regards,

Dr. Shravani Shahapure, CISSP

PhD (Electronics Engineering Specialization in Cryptology)

Quantum Safe Cyber security, Cryptography Specialist

M: +91-7030752913

sshah...@deloitte.com | www.deloitte.com

 

 

 

From: pqc-...@list.nist.gov <pqc-...@list.nist.gov> On Behalf Of Natalia
Sent: Friday, July 31, 2026 8:15 AM
To: Cong Ling <cli...@googlemail.com>
Cc: pqc-forum <pqc-...@list.nist.gov>; dustin...@nist.gov <dustin...@nist.gov>; leo.d...@gmail.com <leo.d...@gmail.com>; sw...@anthropic.com <sw...@anthropic.com>
Subject: [EXT] Re: [pqc-forum] Re: HAWK-n Key Recovery Reduces to SVP in Dimension n/2 + 1

 

You don't often get email from nataliascor...@gmail.com. Learn why this is important

Cong, 

 

I agree with you. I was a bit blown away by the news, but I hate to say that I'm not surprised. Maybe we need a path forward that is not so linear or multiple paths. We can't think like we did before. We need more 4D and 5D thinking. 

 

This loss is unexpected. Thank you Hawk for your contributions. 

Natalia D'Onofrio, FRP, MBA

Affinity Ventures, LLC  |  Founder

P.O. Box 2059

Palm Beach, FL 33480

Tel: (561) 501-1033

 

To view this discussion visit https://groups.google.com/a/list.nist.gov/d/msgid/pqc-forum/CAMux9nCwhiTtBhSb7Tq3Li7goDN4kRYFtpgSGeMT%2BivzCVeiJA%40mail.gmail.com.

This message (including any attachment(s) hereto) is confidential and is intended solely for the use of the individual or the entity to whom they are addressed. In the event, you are not the intended recipient and have received this message in error or inadvertently, you are hereby notified that retaining, disclosing, reproducing, distributing, printing, or taking any action by relying on the contents of the information is strictly prohibited and you are requested to forthwith delete this message without retaining any copy or part thereof. When addressed to our clients, any opinions or advice contained in this email are subject to the terms and conditions expressed in the governing client engagement letter. Any action or omission in contravention of the foregoing requirement may be construed to be against the applicable laws and may have legal consequences. We do not accept any responsibility and are not liable for any incorrect transmission of this message nor for any losses sustained because of this message.

 

[John Mattsson]

And the concrete impact on the current SQIsign parameter sizes is, as far as I know, still unknown. As stated in the paper:

"The impact on concrete parameter sets remains to be clarified, as the asymptotic advantage of the new algorithm is mitigated by a superpolynomial overhead hiding in the o(1) exponent"

You would need a concrete cost analysis to determine where the crossover point occurs. The result could have a major, moderate, or no practical impact on current SQIsign parameter sizes.

One does not withdraw schoolbook multiplication because of the galactic Harvey–van der Hoeven algorithm 😊

https://arxiv.org/pdf/1802.07932

Cheers,

John Preuß Mattsson

To view this discussion visit https://groups.google.com/a/list.nist.gov/d/msgid/pqc-forum/CACsn0ckAJ6ciJ9OH1Tpc1ncQVaH3%3DiBTE5XLJRjd%2B0MYhSoCvw%40mail.gmail.com.

[Arpana Gupta]

Rightly put in saying that AI has beaten humans in cryptanalysis and now our till-date secure communications are under renewed threat of "AI-in-the-middle" attack.

It's only going to be more challenging in future with the combined power of AI and Quantum Machines.

But still cryptography will always be invented/choreographed and re-invented by humans only. Our universe is full of many hidden and hard problems, whose solutions are out of reach of AI, and only humans can find and use them.   

Arpana

--

You received this message because you are subscribed to the Google Groups "pqc-forum" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pqc-forum+...@list.nist.gov.

To view this discussion visit https://groups.google.com/a/list.nist.gov/d/msgid/pqc-forum/85aedddd-2446-4f03-bdc6-34d6149f70fcn%40list.nist.gov.

[Damien Robert]

Here is a message by Guilhem Mureau and Alice Pellet-Mary that they asked me to post on their behalf.

--------------------------------------------

Dear all,

We would also like to share a third key recovery attack on Hawk whose
result is very similar to the one of Hengyi Luo [2], even though we use
yet another mathematical tool. Our article should appear soon on ePrint,
and is accessible for the moment here:
https://apelletm.pages.math.cnrs.fr/page-perso/documents/articles/trace-zero-attack.pdf
<https://apelletm.pages.math.cnrs.fr/page-perso/documents/articles/trace-zero-attack.pdf>

Our attack builds on our previous reduction from rank-2 module-LIP in a
cyclotomic field K to the norm reduced principal ideal problem (nrdPIP)
in a quaternion algebra [1]. We show that this nrdPIP instance can
itself be reduced to module-LIP in a module of rank 3 over the maximal
totally real subfield F of K. This allows us to reduce module-LIP in
modules of rank 2 in K to module-LIP in modules of rank 3 in F (note
that the degree of F is half the degree of K, so we are reducing the
lattice dimension by a factor 3/4).

Applying this to Hawk, we obtain a key recovery attack on Hawk which
makes SVP calls in lattices of dimension at most 3n/4+1 (where n is the
degree of K), which is similar to the attack obtained by Hengyi Luo [2].
The attack of Zygimantas Straznickas and Steve Weis [3] achieves an even
smaller dimension for the SVP calls (namely n/2+1).

The attack itself is quite simple. We wrote a detailed technical
overview section which we hope can be understood by any cryptographer
interested in module-LIP, so that they can get an idea of how the attack
works without reading the full paper.

In the upcoming weeks, we plan to investigate the relationship between
the three attacks. Given the strong similarities between the results, it
seems that the three attacks may be doing very similar things with
different formalism.

Implementation: we did a toy implementation of our attack in SageMath
(available here:
https://plmlab.math.cnrs.fr/apelletm/attack_hawk-trace-zero). We only
implemented the new part of the attack, i.e., the algorithm that solves
nrdPIP via module-LIP in modules of rank 3 over F. Due to limited
computational resources, we were able to run the attack only until n =
128 (which runs in 2 hours on a laptop and uses BKZ with blocksize 30).
The point of the implementation was mostly to make sure that there was
no mistake in our proofs or that we did not overlook something, and the
results are satisfactory.


Guilhem Mureau and Alice Pellet-Mary


LLM disclaimer: We would like to acknowledge that this was found by
humans, with minimal technical guidance from LLMs. More precisely, we
used LLMs for improving the editorial quality of some parts of the
article, and for answering some technical mathematical questions that we
had about quaternion algebras.

References:
[1] Chevignard, C., Mureau, G., Espitau, T., Pellet-Mary, A., Pliatsok,
H., & Wallet, A. A reduction from hawk to the principal ideal problem in
a quaternion algebra. Eurocrypt 2025. ePrint 2025/287
<https://eprint.iacr.org/2025/287.pdf>[2] Luo, H. Adjoint-Lattice
Reduction for the HAWK Gram-Factor Problem. link
<https://harylo.github.io/files/preprints/adjoint-lattice-reduction-for-the-hawk-gram-factor-problem.pdf>
[3] Straznickas, Z. and Weis, S. HAWK-n Key Recovery Reduces to SVP in
Dimension n/2 + 1. link
<https://www-cdn.anthropic.com/e8d50c167ad47beeb03d6109a4a484be95cb38ea/hawk_key_recovery.pdf>

[Betül Durak]

That’s pretty cool. Did they say how much budget they had/used and how long it took? 

--

You received this message because you are subscribed to the Google Groups "pqc-forum" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pqc-forum+...@list.nist.gov.

To view this discussion visit https://groups.google.com/a/list.nist.gov/d/msgid/pqc-forum/09f45a33-bf7c-42cd-956d-ad4fecaccf3cn%40list.nist.gov.

[Cong Ling]

AI has now also surpassed humans in lattice theory... Today, OpenAI announced a new upper bound of 0.604 for the exponent of the sphere-packing density. Improving this upper bound has been a major open problem in lattice theory ever since Kabatiansky and Levenshtein established the previous best exponent of 0.599 in 1978. This is the first improvement in nearly half a century. 

https://cdn.openai.com/pdf/ten-proofs-oai.pdf

On Wednesday, July 29, 2026 at 4:09:58 PM UTC+1 dustin...@nist.gov wrote: