HAWK-n Key Recovery Reduces to SVP in Dimension n/2 + 1

[Steve Weis]

Hello pqc-forum. We would like to announce an improved key recovery attack against HAWK-n that reduces to SVP in dimension n/2 + 1. The paper will appear at https://anthropic.com/document/hawk_key_recovery.pdf and is linked to from an accompanying blog post that will shortly be live: https://www.anthropic.com/research/discovering-cryptographic-weaknesses

In the gate-count model of AGPS'20, the improved attack lowers the key-recovery cost of HAWK-512 from 2^150 to 2^108 and of HAWK-1024 from 2^288 to 2^182. We demonstrate this with a practical implementation that recovers a HAWK-256 secret key end-to-end in a few hours on a single server. The implementation can be found at: https://github.com/anthropics/cryptography-research-demo

This result does not impact Falcon, ML-DSA, or other latticed-based schemes.

We would like to thank the HAWK team for their help verifying this result and for their feedback. We would also like to acknowledge that this was found by Claude, with minimal technical guidance from people. For more information on the process, please refer to the above blog post.

Thank you very much.

[Daniel Apon]

Nice.

It checks out independently for me.

[Hengyi Luo]

Thank you for your sharing—this is really a surprising work. We would also like to share a related piece of work produced by GPT-5.6 with only minimal technical guidance from human researchers, which  attacks HAWK by solving SVP with dimension (3n/4). Although the result is weaker than that of the work above, the approach is different, which may still offer some additional conceptual insight.
We implemented it using Codex and shared the results with the HAWK team, who are currently carrying out their own verification. See more details in
https://harylo.github.io/files/preprints/adjoint-lattice-reduction-for-the-hawk-gram-factor-problem.pdf


We subsequently investigated the geometric idea behind  this attack  and generalize it to rank (4) with the help of GPT. In that setting, an (R^4)-mLIP instance can be reduced to SVP in dimension (3n/2), improving upon the generic approach of treating it directly as a  (\mathbb{Z})-LIP instance with rank (4n).  A draft describing this extension is available here:

https://harylo.github.io/files/preprints/linear-descent-for-rank-2-and-rank-4-module-lip.pdf

[Daniel Apon]

Anonymous research draft 17 July 2026  

Also nice

--
You received this message because you are subscribed to the Google Groups "pqc-forum" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pqc-forum+...@list.nist.gov.
To view this discussion visit https://groups.google.com/a/list.nist.gov/d/msgid/pqc-forum/20febba1-2c24-4da4-a46e-100b66cfdf47n%40list.nist.gov.

[Markku-Juhani O. Saarinen]

Hi All,

Cool stuff.

Not targeted at anyone in particular -- some thoughts and a totally tangential AI cryptanalysis research note.

First, I would encourage practitioners of AI-assisted cryptanalysis always to provide tangible evidence, such as machine-checkable proofs or successful attack demonstrations against scaled-down versions of targets (like Anthropic did). Anything that makes independent validation easier.

Just as AI helps significantly increase code quality & security if used right (more tests, rigorous formal models, etc.), it can also increase positive assurance of (surviving) crypto algorithms themselves: better proofs, research depth, etc. For example, I'd think that expectation in near future is that more complex security proofs and arguments are machine-checkable. Some additional groundwork may be needed for that with Lean and other tools, though.

ps. Here are some (as far as I know) new McEliece structural key recovery records, including a break of TII-252: https://github.com/mjosaarinen/tii-solved

These were solved with HOVER, a new AI-extended version of the Hemmert-Wiemers HOV attack (Crypto 2026).

Cheers,

-markku

Dr. Markku-Juhani O. Saarinen <mj...@iki.fi>

--

[Demi Marie Obenour]

If one mitigates this attack by increasing parameters, does HAWK
still have advantages over other signature algorithms?
--
Sincerely,
Demi Marie Obenour (she/her/hers)

[Minseop Choi]

Anthropic's post states the following: "The automorphism discovered by Mythos allows a faster enumeration attack that, while still exponential, means that one needs to double the size of HAWK keys to achieve the same level of security. Unfortunately, doubling HAWK's key size eliminates many of the reasons making the scheme (as it currently stands) an attractive PQC signature candidate."

2026년 7월 29일 수요일 오전 9시 25분 37초 UTC+9에 Demi Marie Obenour님이 작성:

[Daniel Apon]

Hi markku & all--

I'd actually like to generally agree with markku here, but also take this moment to especially highlight that we are in need of a community-driven "Ten Commandments" for how to adjudicate AI-generated cryptanalytic claims.

For motivation's sake, consider Scott Aaronson's (historical, highly revered, and.. yikes, now-quaint :)) position on "Ten Signs a Claimed Mathematical Breakthrough is Wrong."
https://scottaaronson.blog/?p=304

Let's take this specific example as a serious point of comparison:

With Anthropic's work, we have not only a paper and a claim, but:
i) A clearly written paper. Admittedly there is a lot of new AI-generated mathematical content, but some effort (in my opinion: more effort) has been put into making it digestible.
i.b) Not a variety of 'short drafts' strung together, but something prepared with care for public release.
ii) A process for release that involved interacting with multiple experts for human-review before claiming a major breakthrough.
iii) A scientifically-reproducible set of open-source code that can be audited and run, even adapted to various toy problems.

I'm sure there are a great deal more "Commandments" that can be clearly stated and agreed upon, but I suppose my main thought at the moment is: Unless we take time to articulate what good scientific process is for using AI in public cryptanalysis and evaluating its outputs, we humans will get quickly overwhelmed by too much AI-driven mathematical content/claims to reach consensus on any topic. (And let's be honest-- we can't very well sit here running our own AI verifiers on every possible claim; no central place will easily afford the token count.)

(This all assumes one can't get away from AI-driven cryptanalysis. But clearly we've walked through that door today. No turning back now.)

Kind regards,
--Daniel

To view this discussion visit https://groups.google.com/a/list.nist.gov/d/msgid/pqc-forum/CA%2BiU_qkmoy_K0u0FeMT-YAO6kihGpey4OgKN0nvaiiP29zQhdg%40mail.gmail.com.

[Bas Westerbaan]

HAWK wasn't really looking great to start with because of the missing middle security level. HAWK-1024 basically has the same combined public key+signature size as ML-DSA-44. Of course the signature alone is half the size. That's not that appealing anymore. Even worse, this assumes HAWK-1024 has a good margin above 128-bits, which seems unlikely. If it doesn't have the margin, then we're looking at even larger signatures and keys, and any advantage over ML-DSA-44 has evaporated.

 

--
Sincerely,
Demi Marie Obenour (she/her/hers)

--
You received this message because you are subscribed to the Google Groups "pqc-forum" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pqc-forum+...@list.nist.gov.

To view this discussion visit https://groups.google.com/a/list.nist.gov/d/msgid/pqc-forum/fe52296c-2366-484e-8ccb-b30ec32eaf56%40gmail.com.

[Leo Ducas]

 Dear Steve and pqc-forum,

We would like to thank Anthropic for their contribution to the cryptanalysis of HAWK, and for communicating with us throughout.
We confirm that their attack approximately halves the block size required in lattice reduction to recover (an equivalent) secret key.
Naïve approaches to circumvent this, such as doubling parameters or moving to higher rank modules, make HAWK uncompetitive.
As such, we withdraw our candidate HAWK from NIST's ongoing additional signature scheme standardisation process.

Good luck to all the remaining candidates.
The HAWK team would like to thank everyone who has attacked, contributed to or discussed HAWK since the it's publication in 2022.

-- the HAWK team

[Manuel Barbosa]

Dear all,

My first contribution to this forum to concur with the observations made in the thread and make the obvious point that machine-checked proofs can help, but the infrastructure underneath (the TCB), any assumptions made by the proofs (the leaves in the proof tree) and the actual semantics of claims will still need to be human-checkable.

Manuel

> To view this discussion visit https://groups.google.com/a/list.nist.gov/d/msgid/pqc-forum/CAPxHsSKnQkecrQzY1oFkUJP8J-hFYFR%2Br7Vxn39-w7cKwJ6OMA%40mail.gmail.com.

[dustin...@nist.gov]

All,

NIST would like to thank the HAWK team for all the work they've done on their submission throughout the process.  We have updated our Round 3 page for the onramp to indicate that HAWK has been withdrawn:

https://csrc.nist.gov/Projects/pqc-dig-sig/round-3-additional-signatures

Dustin Moody

NIST PQC

[Cong Ling]

Dear Colleagues,

This is a historic moment in cryptology: AI has beaten humans at cryptanalysis. We would like to share a few thoughts with the PQC community based on our own experience.

There are other dimension-reduction attacks on HAWK in literature. At Eurocrypt 2026, we proposed a dimension-halving algorithm for quaternion Ideal-SVP, which potentially implies that HAWK-n key recovery can be reduced to (cyclotomic) Ideal-SVP in dimension n:

https://eprint.iacr.org/2025/1448

Later, we proposed another guessing attack based on advanced number theory, under a few heuristic assumptions:

https://eprint.iacr.org/2026/1318

However, one of these heuristics was soon found to be invalid by colleagues with the assistance of AI.

Apparently, we were outpaced by AI in both cases. A couple of lessons we have learned are: (a) humans can make mistakes; and (b) humans are slower than AI. Beyond cryptanalysis itself, the use of AI to check mathematical proofs is becoming an increasingly serious issue.

One can even imagine a crisis in cryptography: in the worst-case scenario, all human-designed cryptosystems are broken by AI. Whether or not that happens, a new era—Post-AI Cryptography—has arrived.

Cong Ling