Improved key-recovery attack on HAWK

The problem asks whether the best known key-recovery attack on HAWK can be substantially accelerated. A public preprint now gives a deterministic reduction that does so, together with an experimental recovery of a HAWK-256 secret key.

Known results

• Key recovery for HAWK-$n$ reduces to exact SVP in dimension $n/2+1$.
• The reported costs fall from $2^{150}$ to $2^{108}$ for HAWK-512 and from $2^{288}$ to $2^{182}$ for HAWK-1024.
• HAWK-256 key recovery was demonstrated in a few hours on one server.
• The attack exploits a previously unused Galois involution and lattice structure; the construction does not transfer to Falcon.

2026 attack and withdrawal

An Anthropic researcher working with Claude Mythos Preview discovered the exploitable automorphism and developed the attack. HAWK’s team announced withdrawal from NIST’s additional signature-scheme process. A separate GPT-5.6 approach was weaker and still undergoing verification.

Current status (as of July 2026): The improved attack is established by a public preprint and an HAWK-256 experiment; HAWK has been withdrawn, while verification of the separate GPT-5.6 attack remains open.