up:: NIST Additional Digital Signature Schemes
Why HAWK Was Withdrawn
HAWK was a post-quantum digital signature candidate in NIST’s additional-signatures process, and on 29 July 2026 its own submission team withdrew it. The day before, an improved key-recovery attack was posted to NIST’s public mailing list, credited to an AI model that had found a previously unknown symmetry in the mathematics HAWK rests on. The attack halves HAWK’s effective key size, which means matching the original security claim would require doubling the key and surrendering the compactness that was the scheme’s entire reason to exist. Another cryptographer confirmed the result independently within hours. HAWK was never standardized, never deployed, and never present in any product, and the finalized standards rest on different mathematics and are unaffected.
The short version:
- HAWK is withdrawn and will not be standardized. NIST’s Round 3 project page, updated 29 July 2026, records that “the submission team has withdrawn HAWK from the additional digital signatures standardization process.”
- The trigger was an improved key-recovery attack posted to the pqc-forum mailing list on 28 July 2026, reducing HAWK-n key recovery to a shortest-vector problem in dimension n/2 + 1.
- The underlying discovery came from Anthropic’s Claude Mythos Preview model, which found “a nontrivial automorphism in the lattice used by HAWK” after running for 60 hours at roughly $100,000 in API cost.
- The effect is a halving of what Anthropic calls the “effective keysize,” so “one needs to double the size of HAWK keys to achieve the same level of security.”
- Nothing you use is affected. HAWK was a competition candidate. ML-KEM, ML-DSA and SLH-DSA rest on different assumptions, and Anthropic states the attack “does not impact the other NIST post-quantum cryptographic schemes.”
- HAWK was the only lattice scheme among the nine Round 3 candidates, so the on-ramp now carries no lattice option.
What actually happened, in order
The whole sequence ran in about 2 days, in public, on a mailing list anyone can read.
| When | What |
|---|---|
| 28 July 2026, 11:06 AM | Steve Weis posts “HAWK-n Key Recovery Reduces to SVP in Dimension n/2 + 1” to the NIST pqc-forum, putting HAWK-512 key recovery at roughly 2^108 where the design target was about 2^150 |
| 28 July 2026, 3:54 PM | Daniel Apon replies on the same thread: “It checks out independently for me” |
| 28 July 2026 | Anthropic publishes its account, attributing the discovery to Claude Mythos Preview and describing the flaw as a nontrivial automorphism in HAWK’s lattice |
| 29 July 2026 | The HAWK submission team withdraws the scheme, and NIST updates its Round 3 project page the same day to record the withdrawal |
Source: pqc-forum thread, “HAWK-n Key Recovery Reduces to SVP in Dimension n/2 + 1,” groups.google.com; Anthropic, “Discovering cryptographic weaknesses,” 28 July 2026, anthropic.com; NIST, “Round 3 Additional Signatures,” updated 29 July 2026, csrc.nist.gov.
What was the flaw?
HAWK’s security rested on the lattice isomorphism problem, the difficulty of telling whether two lattices are secretly the same lattice viewed through a hidden transformation. Earlier research had established that a certain kind of hidden symmetry in such a lattice, called a nontrivial automorphism, would open the scheme to attack. That was a known conditional weakness, and the open question was whether HAWK’s particular lattice contained one.
It did. Anthropic reports that Claude Mythos Preview found one, which converts the conditional weakness into an actual attack. The practical consequence is stated plainly in Anthropic’s write-up: the attack “reduces the ‘effective keysize’ by a factor of two,” so “one needs to double the size of HAWK keys to achieve the same level of security.”
Source: Anthropic, “Discovering cryptographic weaknesses,” 28 July 2026, anthropic.com.
How serious is the attack, precisely?
Serious enough to end the scheme, and considerably narrower than the headlines suggest. Three qualifications travel with it.
- It stays exponential. Anthropic describes the attack as “faster exponential time” and states it “does not run in polynomial time.” A polynomial-time attack would mean the scheme falls outright at any parameter size. This one raises the attacker’s discount rather than handing over the key.
- The dramatic number is on a parameter set nobody proposed for use. The often-quoted drop from 2^64 to 2^38 is for HAWK-256, which sits below the parameter sets HAWK submitted for NIST security levels. Those are HAWK-512 at level 1 and HAWK-1024 at level 5.
- The scheme died on economics rather than on catastrophe. HAWK’s pitch was a compact, fast lattice signature that avoided the floating-point difficulty of Falcon. Doubling the key to restore the security margin removes the compactness, and a scheme with no advantage has no case for standardization.
Why did an AI finding it matter?
Because of the cost and the clock rather than the mathematics. A published attack is a published attack no matter who derives it, and the pqc-forum thread treated it that way: a human cryptographer reproduced the result within about 5 hours and the submission team acted on it the next day. The process worked exactly as a public standardization process is supposed to work.
What is genuinely new is the price. 60 hours of machine time and roughly $100,000 in API cost is inside the reach of a very large number of organizations, and it is far below the cost of the multi-year human research programs that have historically produced results of this kind. The same Anthropic write-up also reports an improvement against a reduced 7-round variant of AES-128, between 200 and 800 times faster depending on technique, which leaves the full 10-round standard untouched.
Source: Anthropic, “Discovering cryptographic weaknesses,” 28 July 2026, anthropic.com.
What does this change for a migration plan?
Very little in the immediate term, and one thing durably.
The immediate reading is that nothing on a normal roadmap moves. HAWK was a candidate under evaluation, so no production system signed anything with it and no vendor shipped it. Anyone deploying the finalized standards today is exactly where they were on 27 July.
The durable reading is about the difference between a candidate and a standard. HAWK cleared the Round 1 submission bar in 2023, advanced to Round 2 in October 2024, and advanced to Round 3 in May 2026, which is years of public expert scrutiny, and it was removed from the field in about a day. Any plan built on a scheme that has yet to be finalized carries that risk by construction, which is the argument for crypto-agility stated in concrete terms: the ability to change algorithm without re-architecting is what makes an event like this a configuration change rather than a project.
Common misconceptions
- “An AI broke post-quantum cryptography.” An AI contributed to breaking one competition candidate that was never standardized and never deployed. The finalized standards rest on different mathematical assumptions and are unaffected.
- “This means lattice cryptography is unsafe.” HAWK rested on the lattice isomorphism problem. ML-DSA and ML-KEM rest on Module-LWE and NTRU, which are different assumptions with far longer scrutiny behind them.
- “AES was broken too.” The AES result applies to a reduced 7-round variant of AES-128. Full AES-128 has 10 rounds and is untouched.
- “The standards process failed.” The opposite reading fits the evidence better. A weakness was found, published openly, independently confirmed within hours, and acted on by the submitters the next day. Removing weak candidates before standardization is the purpose of the exercise.
- “HAWK was a NIST finalist.” HAWK was a Round 3 candidate in the additional-signatures on-ramp, a separate and later effort from the main competition that produced ML-KEM, ML-DSA and SLH-DSA.
Questions people ask
Was HAWK ever a standard? No. It was a candidate in NIST’s additional digital signature schemes process, which had reached its third round in May 2026 and had produced no finalized standard.
Is any of my encryption affected? No. HAWK was never deployed in any product or protocol. If your systems use the finalized post-quantum standards or classical cryptography, nothing about this changes your position.
Who found the flaw? Anthropic attributes the discovery to its Claude Mythos Preview model, which ran for 60 hours at roughly $100,000 in API cost. The improved attack was posted to NIST’s pqc-forum by Steve Weis on 28 July 2026 and independently confirmed on the same thread by Daniel Apon.
Could the same thing happen to ML-DSA? Nothing rules it out in principle, which is why the on-ramp exists and why crypto-agility is the standing recommendation. ML-DSA rests on a different and much more heavily studied assumption, and Anthropic explicitly states the HAWK attack does not carry over.
Why can’t HAWK simply use bigger keys? Doubling the key restores the security margin and removes the reason to prefer HAWK, since compactness and speed were its advantages over the already-standardized lattice signature. A candidate with no remaining advantage has no path to standardization.
What happens to the on-ramp now? Eight Round 3 candidates remain: SQIsign, FAEST, MQOM, SDitH, UOV, MAYO, QR-UOV and SNOVA. None is lattice-based, since HAWK was the only one.
HAWK is the clearest public example so far of a candidate scheme being removed from a standardization process on evidence, quickly, before anyone deployed it. That is the process functioning. Everything here is the map, given freely. When your team needs to work out what your own exposure to a candidate-stage algorithm actually is, that’s the work I do.
Last verified 2026-08-04 · Updated 2026-08-25 · Maintained by Addie LaMarr, LaMarr Labs.