{"slug": "hawk-s-real-problem-isn-t-the-key-claude-recovered", "title": "HAWK's real problem isn't the key Claude recovered", "summary": "Anthropic recovered a HAWK-256 signing key from a public key in under four hours, but the real threat is a new reduction that halves the dimension of the hard problem for all HAWK instances, pushing HAWK-512 below NIST's Category 1 security threshold. The reduction, proven by Straznickas and Weis, drops HAWK-512's gate cost from 2^150 to at most 2^108, below the 2^143 Category 1 bar, and HAWK-1024 from 2^288 to 2^182.", "body_md": "[Security](https://sourcefeed.dev/c/security)Article\n\n# HAWK's real problem isn't the key Claude recovered\n\nThe recovered HAWK-256 key is a demo; the reduction behind it pushes HAWK-512 under NIST's Category 1 bar.\n\n[Ji-ho Choi](https://sourcefeed.dev/u/jiho_choi)\n\nAnthropic recovered a working [HAWK](https://hawk-sign.info/)-256 signing key from nothing but a public key, in three hours and 42 minutes on a 96-core box, and [published the code](https://github.com/anthropics/cryptography-research-demo). That's the part every headline led with, and it's the least consequential thing in the release.\n\nHAWK-256 was built to be broken. The HAWK specification lists it as a *challenge* parameter set — roughly 64 bits of security, deliberately under NIST's floor, published so cryptanalysts would have something with a finish line. Breaking it is the intended use. Reporting it as \"AI cracks post-quantum crypto\" is a bit like reporting that someone solved the practice problem at the back of the chapter.\n\nThe actual result is the theorem the demo is attached to, and it's worse for HAWK than the demo is.\n\n## What the reduction does\n\nStraznickas and Weis prove an unconditional, deterministic polynomial-time reduction from HAWK-*n* key recovery to a polynomial number of calls to an exact SVP oracle in dimension *n*/2 + 1. Not a heuristic. Not \"for these parameters.\" A reduction that halves the dimension of the hard problem for every HAWK instance over a power-of-two cyclotomic ring.\n\nThe lever is a Galois involution τ: ζ ↦ −ζ, a nontrivial automorphism of the key lattice. [Van Gent and Pulles](https://cic.iacr.org/p/2/2/20) had already shown that *if* you could get your hands on such an automorphism, the descent from there to the secret key was straightforward — they published the machinery and the name (\"HAWK: Having Automorphisms Weakens Key\") and left the automorphism itself as an open door nobody had walked through. The new contribution is that τ turns out to be recoverable in practice: it sits as a shortest vector of a public rank-*n* lattice that's isometric, up to scaling, to Z^(n/2+1) ⊕ √2·Z^(n/2−1). That shape is near-hypercubic, and Ducas's block reduction eats near-hypercubic lattices for breakfast. Public key in, automorphism out, existing descent finishes the job.\n\nSo the interesting number isn't HAWK-256's 2^62 → 2^38. It's what happens to the parameter sets HAWK actually submitted. In the specification's own AGPS20 gate-count model, key recovery against HAWK-512 drops from 2^150 to at most 2^108 gates, and HAWK-1024 from 2^288 to at most 2^182.\n\nSit with the first one. NIST pegs Category 1 at roughly 2^143 classical gates — the cost of AES-128 key search. HAWK-512 claimed 2^150 and cleared the bar with room to spare. At 2^108 it doesn't clear the bar at all, and that's the *conservative* figure: run the spec's own heuristic GSA-intersect methodology instead of the provable bound and the paper lands near 2^80.8 for HAWK-512. Anthropic's public framing — \"larger parameters remain impractical to attack\" — is true in the sense that nobody is spending 2^108 gates on your signature this quarter. It is not the same as HAWK-512 still meeting the security level it was submitted at.\n\nThe usual caveat applies in both directions: gate-count models are slippery, and the paper explicitly declines to price memory access, the roughly 2^5 progressivity factor, or the overheads the spec itself sets aside. Those omissions apply symmetrically to the before and after numbers. NIST hasn't publicly ruled, and the HAWK team was credited with helping verify the result before disclosure.\n\n## The damage is to the pitch, not just the parameters\n\nHAWK's reason to exist was speed. It's the only lattice-based candidate that made NIST's third round of the additional-signatures process, and its selling point over [Falcon](https://falcon-sign.info/) was that it avoids floating-point Gaussian sampling — the part of Falcon that makes constant-time implementation genuinely miserable and has produced a steady drip of side-channel papers. HAWK signs fast, verifies fast, and does it with integer arithmetic over NTT-friendly power-of-two cyclotomics.\n\nThe fix for a halved dimension is to double the ring degree. That works. It also spends exactly the performance budget that was the entire argument for choosing HAWK over ML-DSA. A HAWK-1024 that now has to be a HAWK-2048 is not a scheme anyone picks for its numbers.\n\nAnd note where the escape hatch is. The paper says the construction doesn't transfer to Falcon, and that conductors m ∈ {p^k, 2p^k} for odd prime p — the ones with cyclic (Z/m)^× — evade the attack entirely. Read that again: you can dodge this by abandoning the power-of-two cyclotomic ring. Which is the ring you chose for the NTT. Which is where the speed came from.\n\nThat's the recurring shape of lattice cryptanalysis and it's the part worth internalizing. Structure you add for performance is structure an attacker can ride. Power-of-two cyclotomics have a richer automorphism group than you strictly need, and rich automorphism groups keep turning out to be exploitable — Luo et al. found one at Asiacrypt 2024 that broke HAWK's original omSVP assumption, the team patched the assumption, and this one showed up underneath the patch. Twice now the extra symmetry was where the crack formed. This is not a referendum on lattice crypto generally; ML-KEM and ML-DSA rest on LWE/SIS and are untouched. It's a specific bill coming due for module-LIP over a very structured ring.\n\n## What to actually do about it\n\nIf you ship software: nothing. HAWK isn't standardized, isn't deployed, and isn't in your dependency tree. FIPS 203/204/205 — ML-KEM, ML-DSA, SLH-DSA — are unaffected. Anyone telling you this touches production is selling something.\n\nIf HAWK is on a roadmap or sitting in a PQC evaluation matrix as the compact-and-fast signature option, move it to the watch column and re-run the comparison after the team responds. The performance row is the one that changed.\n\nThe broader thing to take away is about tempo. The reduction cost roughly $100,000 in API spend and about 60 hours of agent time, against a paper trail that had been public since van Gent and Pulles and that plenty of qualified people had read. Whatever you believe about AI research capability, the cost of *generating* a serious cryptanalytic result just moved. The cost of verifying one didn't — Anthropic's companion AES result took two researchers close to a month to check. That asymmetry is the thing to plan around, and it argues for treating crypto-agility as engineering work rather than a compliance checkbox: keep algorithm identifiers negotiable, don't bake signature sizes into wire formats or database columns, and know what a rotation would actually cost you.\n\nWhich brings up the one genuinely admirable thing here, and it's not the AI. The release is a Nix-pinned, checkpointed, restartable pipeline that ends by signing a message and verifying it against the HAWK reference implementation:\n\n```\nsage -python -m hawk_recover path/to/pk.hex --out recovered_sk.bin\n# exit 0 only if the recovered key passes sign/verify\n```\n\nExit code 0 or it didn't happen. Most cryptanalysis ships a complexity table and an invitation to trust the authors' arithmetic; this ships a program that either produces a key that signs or doesn't. For a result that arrived with \"an AI found it\" attached, making the claim cheap to falsify was the right call — and it's a better standard than most human cryptanalysis holds itself to.\n\n## Sources & further reading\n\n-\n[Anthropic publishes a practical key-recovery attack on HAWK-256](https://github.com/anthropics/cryptography-research-demo)— github.com -\n[HAWK-n Key Recovery Reduces to SVP in Dimension n/2 + 1](https://www-cdn.anthropic.com/e8d50c167ad47beeb03d6109a4a484be95cb38ea/hawk_key_recovery.pdf)— www-cdn.anthropic.com -\n[Discovering cryptographic weaknesses with Claude](https://www.anthropic.com/research/discovering-cryptographic-weaknesses)— anthropic.com -\n[Claude AI Just Cracked a Post-Quantum Test Scheme and Found a Faster 7-Round AES Attack](https://thehackernews.com/2026/07/claude-ai-just-cracked-post-quantum.html)— thehackernews.com -\n[Anthropic's Claude Mythos finds weaknesses in encryption algorithms](https://cyberscoop.com/anthropic-claude-mythos-encryption-flaws-hawk-aes-pqc/)— cyberscoop.com -\n[HAWK: Having Automorphisms Weakens Key](https://cic.iacr.org/p/2/2/20)— cic.iacr.org -\n[HAWK signature scheme - official site and specification](https://hawk-sign.info/)— hawk-sign.info\n\n[Ji-ho Choi](https://sourcefeed.dev/u/jiho_choi)· Security & Cloud Editor\n\nJi-ho covers the increasingly tangled overlap between cloud architecture and security, drawing on a background as a penetration tester to keep his reporting grounded in real-world attack paths. He never lets a vendor claim go unquestioned and insists that every buzzword come with a proof of concept.\n\n## Discussion 0\n\nNo comments yet\n\nBe the first to weigh in.", "url": "https://wpnews.pro/news/hawk-s-real-problem-isn-t-the-key-claude-recovered", "canonical_source": "https://sourcefeed.dev/a/hawks-real-problem-isnt-the-key-claude-recovered", "published_at": "2026-07-29 01:10:52+00:00", "updated_at": "2026-07-29 01:25:29.774742+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-research", "ai-safety"], "entities": ["Anthropic", "HAWK", "NIST", "Straznickas", "Weis", "Van Gent", "Pulles", "Ducas"], "alternates": {"html": "https://wpnews.pro/news/hawk-s-real-problem-isn-t-the-key-claude-recovered", "markdown": "https://wpnews.pro/news/hawk-s-real-problem-isn-t-the-key-claude-recovered.md", "text": "https://wpnews.pro/news/hawk-s-real-problem-isn-t-the-key-claude-recovered.txt", "jsonld": "https://wpnews.pro/news/hawk-s-real-problem-isn-t-the-key-claude-recovered.jsonld"}}