HAWK Withdrawn After an AI-Discovered Attack: What It Means for Post-Quantum Signatures

Abstract

Key Points at a Glance

1. Four Dates That Changed HAWK's Future

HAWK's withdrawal was not the result of a production breach or a quantum computer suddenly becoming operational. It was the endpoint of a public research process. NIST had opened its Additional Digital Signatures project to broaden the post-quantum signature portfolio beyond the algorithms already selected in its first competition. After approximately 18 months of second-round evaluation, HAWK was one of nine candidates invited into the third round on 14 May 2026.^[5]

According to Anthropic, the attack was shared privately with HAWK's authors in June under a coordinated-disclosure process. Anthropic published its explanation, paper, and demonstration code on 28 July.^[4][6] NIST's candidate page records the development team's withdrawal the following day.^[1] That sequence is significant: researchers found a design weakness, gave the authors time to assess it, made the evidence reproducible, and removed the affected candidate before standardisation.

2. What HAWK Was—and Why NIST Was Studying It

Digital signatures answer a different security question from encryption. They allow a verifier to determine whether software, a document, a certificate, or a transaction was authorised by the holder of a private key and whether the signed data was altered. Today's common signature systems, including RSA and ECDSA, are vulnerable to a sufficiently capable quantum computer running Shor's algorithm. This is why signature migration is an essential part of the post-quantum transition, even though its timing and operational risks differ from the harvest-now, decrypt-later problem facing confidential data.

NIST has already standardised ML-DSA in FIPS 204 and SLH-DSA in FIPS 205.^[7][8] Its additional-signature process seeks more diversity: different mathematical foundations, performance characteristics, signature sizes, and implementation trade-offs can provide alternatives when one family is unsuitable or a new weakness appears. HAWK was especially interesting because it offered compact signatures and keys, fast signing, and a floating-point-free design.^[9]

HAWK is a lattice-based signature scheme, but it does not rely on exactly the same assumptions and structure as every other lattice system. At a high level, its public key encodes the geometry of a secret lattice basis without revealing that basis directly. Its security argument depends on the difficulty of recovering an equivalent secret basis from the public information—a form of the lattice isomorphism problem. The newly discovered attack targets special algebraic structure in HAWK's chosen power-of-two cyclotomic setting. That specificity is central to understanding the result.

3. The Attack in Plain Language

Imagine publishing the shape of an intricate geometric object while keeping the short, convenient coordinate system used to construct it secret. An attacker can see the object's public Gram matrix, which records inner products and therefore its geometry, but should not be able to reconstruct a secret basis that can produce valid signatures. The direct attack was expected to require solving a difficult shortest-vector problem in a high-dimensional lattice.

The researchers found that HAWK's lattice contains an additional symmetry—technically, a nontrivial Galois automorphism—that had not been exploited by the earlier security analysis. This symmetry lets the attacker derive a publicly computable auxiliary lattice containing a vector connected to the secret key. Crucially, finding that vector can be reduced to shortest-vector problems in roughly half the original dimension. Once the relevant automorphism is recovered, a descent procedure reconstructs an equivalent signing key from the public key.^[3]

This is a mathematical design attack, not a bug in one HAWK software library. Patching an implementation would not restore the original security estimates. The candidate's parameters or algebraic setting would need substantial redesign, and the paper argues that increasing key sizes enough to recover the intended margins would undermine much of HAWK's compactness advantage. That helps explain why withdrawal was the cleaner outcome.

4. What the Revised Numbers Actually Mean

Headlines such as “AI cuts the key strength in half” are easy to misread. Security estimates are expressed as powers of two, and the paper evaluates costs in a particular gate-count model. A reduction from 2^150 to 2^108 is enormous from a cryptographic-design perspective, even though 2^108 operations remain far beyond a practical attack today. The most concrete result is the end-to-end recovery of a HAWK-256 key, which demonstrates that the structural insight is real rather than merely theoretical.

The estimates above come from the attack paper and its use of the HAWK specification's gate-count model.^[3] They should not be translated directly into elapsed time for arbitrary hardware. The sound conclusion is narrower: HAWK's claimed security margins no longer hold under the best-known attack, and restoring those margins would impose unattractive parameter costs. It is not sound to conclude that every HAWK parameter can now be broken on a laptop.

5. What Was—and Was Not—Broken

NIST responded directly to the risk of overgeneralisation: the agency states that the finding does not affect finalised standards such as ML-KEM and ML-DSA, which remain ready for implementation.^[2] Organisations should therefore continue their approved PQC programmes. Replacing a planned ML-DSA deployment because HAWK was withdrawn would confuse two schemes with different constructions and security analyses.

The episode also demonstrates why “lattice-based” is too broad a label for reasoning about security. Lattice schemes can rely on different problems, rings, modules, distributions, and implementation techniques. A structural attack against one design is a reason to re-examine related assumptions carefully, but not evidence that the entire field has collapsed. The same discipline applies in the opposite direction: the survival of one lattice scheme does not automatically validate another.

6. AI Is Becoming a Cryptanalytic Instrument

Anthropic describes the HAWK work as a semi-autonomous collaboration between an AI system and a human researcher. The system reviewed literature, developed hypotheses, performed mathematical reasoning, ran computational experiments, and implemented a verification pipeline. Human input included project management, tool selection, validation, responsible disclosure, and publication. Anthropic reports that discovery and verification took approximately 60 hours and cost about $100,000 in API usage.^[4] Those duration and cost figures are the company's own account, not independent performance benchmarks.

That distinction matters. The result was not trustworthy merely because a model produced it. It became persuasive because there was a formal argument, working demonstration code, consultation with other researchers, disclosure to the scheme's authors, and a response from the standards process. In cryptography, an attractive idea is the start of the work. Reviewers still need to check definitions, reproduce experiments, examine hidden assumptions, compare prior art, and determine whether an attack applies beyond the tested cases.

AI can nevertheless change the economics of adversarial review. Candidate schemes sit within a huge landscape of papers, parameter choices, algebraic structures, and possible attack combinations. Systems that can search this landscape continuously, coordinate several lines of investigation, and turn promising ideas into executable experiments may expose more weaknesses earlier. The likely bottleneck then moves downstream: scarce human experts must triage a larger volume of claims and decide which results are correct, novel, ethically publishable, and operationally relevant.

7. Practical Lessons for PQC Programmes

For most security teams, the correct response is not to abandon post-quantum migration. It is to make migration more disciplined. HAWK's withdrawal demonstrates the value of waiting for final standards when selecting production algorithms, while simultaneously preparing systems so algorithms can be replaced without another decade-long infrastructure project.

• Deploy approved standards for approved use cases. Base production signature planning on finalised specifications such as ML-DSA and SLH-DSA, not on research candidates whose evaluation is still active.
• Build crypto-agility into formats and trust systems. Record algorithm identifiers explicitly, support controlled policy changes, separate keys by purpose, and avoid assuming that one signature scheme will serve every product for its entire lifetime.
• Track lifecycle status. Maintain a clear distinction between candidate, selected, standardised, validated, supported, and deployed algorithms. These words are not interchangeable.
• Demand reproducible evidence. Treat AI-generated cryptanalytic claims as hypotheses until formal reasoning, code, independent review, and realistic impact analysis support them.
• Keep signature migration moving. HAWK creates no emergency replacement event for ML-DSA or SLH-DSA. It reinforces the need for diversified, reviewable, and replaceable cryptographic designs.

Signature migration also needs to be prioritised by use case. A code-signing root or firmware trust anchor may remain active for many years and can give an attacker broad control if forged; our code-signing analysis examines that risk in detail. TLS authentication has different timing properties from key exchange, as explained in Key Exchange vs. Digital Signatures. Meanwhile, ML-KEM addresses key establishment and is outside the scope of the HAWK signature attack.

8. A Warning—and Evidence That Review Works

HAWK's withdrawal is a warning about the difficulty of designing new cryptography. A scheme can be efficient, elegant, and reviewed by experts yet still contain exploitable structure. AI-assisted research increases the chance that such structure will be found, and it may compress years of exploratory work into much shorter cycles. That creates new pressure on researchers, standards bodies, and disclosure systems.

But this is also the reassuring interpretation: the weakness was discovered while HAWK was still a candidate. The attack was documented, demonstrated, communicated, and acted upon before deployment. Public cryptographic competitions are designed to eliminate fragile ideas under adversarial scrutiny. HAWK did not show that the PQC transition is failing; it showed why transparent evaluation and algorithm diversity are indispensable to making that transition safe.

The practical message is therefore steady rather than dramatic. Continue migrating away from quantum-vulnerable RSA and elliptic-curve systems. Use final standards, preserve algorithm agility, monitor new cryptanalysis, and expect AI to become part of both attack discovery and defensive review. The goal is not to find an algorithm that can never be questioned. It is to build systems and institutions that can respond intelligently when one is.

Further Reading

For a deeper explanation of why post-quantum key exchange and digital signatures follow different migration timelines, read our companion analysis:

How to Cite This Article

@misc{pqcryptography_ai_pqc_signature,
  author       = {{PostQuantumSecurity.org}},
  title        = {HAWK Withdrawn After an AI-Discovered Attack: What It Means for Post-Quantum Signatures},
  year         = {2026},
  month        = sep,
  day          = {4},
  url          = {https://www.postquantumsecurity.org/publications/ai_pqc_signature.html}
}

References

1. National Institute of Standards and Technology. (2026). Nine Candidates Advance to the Third Round of the Additional Digital Signatures for the PQC Standardization Process. Updated 29 July 2026 to record HAWK's withdrawal. NIST.
2. National Institute of Standards and Technology. (2026). Post-quantum cryptography. NIST's clarification states that the HAWK finding does not affect its finalised PQC standards. NIST.
3. Straznickas, Z., & Weis, S. A. (2026). HAWK-n Key Recovery Reduces to SVP in Dimension n/2 + 1. Technical paper.
4. Anthropic. (2026). Discovering cryptographic weaknesses with Claude. Anthropic Research.
5. Alagic, G., et al. (2026). Status Report on the Second Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process, NIST IR 8610. https://doi.org/10.6028/NIST.IR.8610.
6. Anthropic. (2026). Cryptography Research Demonstration Code. GitHub repository.
7. National Institute of Standards and Technology. (2024). FIPS 204: Module-Lattice-Based Digital Signature Standard. NIST CSRC.
8. National Institute of Standards and Technology. (2024). FIPS 205: Stateless Hash-Based Digital Signature Standard. NIST CSRC.
9. Ducas, L., Prest, T., Pulles, L. N., & van Woerden, W. (2025). HAWK Specification. NIST-hosted specification.