What the HAWK Withdrawal Means for PQC Migration

HAWK is out of the NIST standardization process. The post-quantum signature scheme had survived two rounds of expert evaluation over two years before Anthropic published an improved key-recovery attack this week, found in about sixty hours by its restricted Claude Mythos Preview model at roughly $100,000 in compute cost. The scheme was withdrawn within a day.

What the attack does

HAWK’s security rests on the Lattice Isomorphism Problem. The best classical attacks work by finding automorphism symmetries in the lattice. Mythos located a symmetry that prior analysis had left unused. The result roughly halves the scheme’s security level. The attack code recovers keys in hours against the challenge instance HAWK’s designers published for adversarial review. Against the proposed deployment parameters the attack remains exponential.

The damage is economic. Doubling key sizes would restore the security margin, and efficiency was HAWK’s entire case for existing. Sophie Schmieg at Google put it directly: “Basically with this paper, HAWK is dead.”

The method matters more than the target. Matthew Green’s review notes that the attack contains no new mathematics. It assembles known tools from the literature more thoroughly than any human team had. An Anthropic operator with no cryptographic training directed the model. Literature review, mathematical reasoning, computational experiments, and an end-to-end verification pipeline all ran inside the agentic harness.

What the attack does not do

No deployed system is affected. HAWK was a candidate. The attack does not transfer to Falcon (FN-DSA), which rests on a different hard problem. ML-KEM, ML-DSA, and SLH-DSA are untouched.

The companion AES result is smaller than headlines suggest. It improves a meet-in-the-middle attack against a 7-round variant of the cipher by a constant factor over work from 2012 and 2013. Specification AES runs 10 to 14 rounds. The attack needs around 2¹⁰⁵ chosen plaintexts and 2⁸⁹ operations, so it exists on paper. Green’s assessment: interesting technique, no practical relevance.

What changed this week

The cost structure of cryptanalysis. HAWK’s design consumed years of specialist work on top of a decade of lattice research. The attack that ended it cost $100,000 and a long weekend. That price falls with every model generation. Only the attack side of the ledger is getting cheaper.

Green draws the useful conclusion. Public-key cryptography depends on a small set of conveniently structured hard problems, and none of them have received enough analyst-hours to rule out further attacks. Machine cryptanalysis supplies those hours at scale. Candidates will now be stress-tested faster and more thoroughly than human review ever managed. A scheme that survives this environment earns more trust than one that survived committees. HAWK breaking before deployment is the process working.

What it means for migration planning

Algorithm selection just became more provisional. A third-round candidate lost its standing in one news cycle. The standards you deploy today, ML-KEM and ML-DSA, have deeper analysis behind them, and they still rest on lattice assumptions that machine review will keep probing. BSI TR-02102-1 requires hybrid key exchange for this reason: a classical component protects you if the post-quantum component fails early.

The durable asset in this environment is swap capability. An organization that knows which algorithms run where, on every protocol and every port, can replace a primitive when the literature moves. An organization without that inventory cannot, at any budget. [PQ]probe measures the first condition: what is deployed, where, and whether the trajectory holds against your deadline. CNSA 2.0 and BSI schedules are unchanged, and the pace of cryptanalytic review around them has increased.

Sources: