AI cryptanalysis forces HAWK out and hardens the SSH ML-DSA fight

When the HAWK team withdrew its NIST additional-signature candidate in late July, the reason was not a slow academic erosion of parameters. It was a concrete key-recovery reduction, found with Claude and published by Anthropic researchers, that cut the lattice dimension in half and made the scheme uncompetitive overnight. Days later the same theme surfaced in the IETF SSH working group’s call for adoption of ML-DSA signature drafts: participants cited the new pace of AI-assisted breaks as grounds to treat pure post-quantum options as riskier than hybrids. Machine-found cryptanalysis is no longer a hypothetical for the next decade; it is already an active variable in which algorithms stay in the process and which protocol profiles get written down.

Steve Weis announced the result on the pqc-forum: an improved attack on HAWK-n that reduces key recovery to SVP in dimension n/2 + 1. In the gate-count model the cost for HAWK-512 fell from roughly 2^150 to 2^108 and for HAWK-1024 from 2^288 to 2^182. A practical end-to-end recovery of a HAWK-256 secret key ran in a few hours on one server. Crucially, the write-up stated that the attack does not touch Falcon, ML-DSA or other lattice schemes in the same family. The striking claim was process, not just asymptotics: “this was found by Claude, with minimal technical guidance from people.”

The HAWK team confirmed the dimension halving and withdrew. “Naïve approaches to circumvent this, such as doubling parameters or moving to higher rank modules, make HAWK uncompetitive,” they wrote. “As such, we withdraw our candidate HAWK from NIST’s ongoing additional signature scheme standardisation process.” Dustin Moody recorded the official update on the Round 3 on-ramp page. Daniel Apon’s terse reaction on the list (“Nice. It checks out independently for me.”) captured the community’s rapid verification.

The Anthropic result did not arrive in isolation. Cong Ling’s group had already published dimension-halving work on quaternion Ideal-SVP and a later guessing attack; one of their heuristic assumptions was itself invalidated “by colleagues with the assistance of AI.” Guilhem Mureau and Alice Pellet-Mary posted a third independent reduction, routing through the norm-reduced principal ideal problem to module-LIP over the totally real subfield and obtaining SVP calls in dimension at most 3n/4 + 1. Their effort cost roughly two person-months of ordinary academic time. Watson Ladd underlined why only HAWK left the field: “halving the dimension makes it no longer completive with existing signatures based on lattices.” John Mattsson, discussing a separate asymptotic improvement against SQIsign, cautioned against automatic withdrawal: “One does not withdraw schoolbook multiplication because of the galactic Harvey-van der Hoeven algorithm.” The contrast is sharp. When the concrete security level collapses below the competition, the candidate exits; when the overhead remains superpolynomial, the community waits for cost analysis.

Cong Ling framed the larger shift: “This is a historic moment in cryptology: AI has beaten humans at cryptanalysis.” The lessons he drew were blunt: humans make mistakes and humans are slower. Arpana Gupta echoed the threat language (“AI-in-the-middle”) while insisting that new hard problems will still be found by people. The technical substance underneath the rhetoric is straightforward for implementers. HAWK’s security rested on the hardness of lattice problems whose dimension scaled with the cyclotomic degree. Once a reduction reliably maps the secret-key search onto an SVP instance of half that dimension, every parameter set that was tuned against the old bound becomes either insecure or larger and slower than Falcon or ML-DSA. No amount of implementation cleverness recovers the lost ground.

That same week the SSHM working group opened a three-week call for adoption. Chairs Stephen Farrell and Job Snijders asked only which hybrid composite-sigs draft and which pure ML-DSA draft should serve as starting points; algorithm combinations and seed formats were deferred. The thread did not stay procedural. Ken Kubota argued that “the catastrophic failure of NIST PQC finalists is not a new phenomenon” and that “hybrid solutions remain the only viable option, while any non-hybrid (or “solo”) approach represents a significant security risk.” What is new, he wrote, is “a paradigm in which numerous new cryptographic researchers appear via AI models that also generate novel attacks.” Jan Schermer pushed back that the HAWK break itself, not toy reduced-round AES results, is the relevant illustration. Side discussions on Grover and AES-128 (Soatok Dreamseeker, Bas Westerbaan, Roger Grimes, John Mattsson) reconfirmed the long-standing consensus that Grover is not an immediate symmetric-key threat, yet they did not dispel the broader anxiety: if AI can compress years of lattice cryptanalysis into weeks, pure ML-DSA deployments locked into SSH now may look different in five years.

The two venues are linked by more than calendar coincidence. NIST’s on-ramp and the IETF’s protocol profiles both select algorithms under incomplete cryptanalysis. HAWK’s exit shows that an AI-assisted reduction can remove a candidate faster than the human review cycle can react. The SSH adoption call shows participants already treating that speed as a reason to keep hybrid constructions first-class rather than transitional. Neither process has a settled rule for how much weight to give machine-found breaks. Falcon and ML-DSA remain untouched by the specific HAWK technique, yet the existence proof that large-language-model assistance can surface dimension reductions and invalidate heuristics has changed the prior.

Where matters stand is therefore unsettled on two axes. On the NIST side, HAWK is gone; the remaining additional-signature candidates continue without a new consensus on how to budget for AI-accelerated attack discovery. On the IETF side, the call for one hybrid and one pure ML-DSA draft is still open, with safety arguments that explicitly reference the new cryptanalytic tempo still unresolved. The concrete technical question for both communities is no longer whether AI will eventually matter for post-quantum selection. It is how to update security margins, review timelines and hybrid policy now that it already has.