AI lattice break sinks HAWK as SSH races to adopt ML-DSA

The withdrawal of HAWK from NIST's additional post-quantum signatures process arrived with unusual speed and an unusual author credit. Within days of Anthropic posting a key-recovery result that roughly halves the lattice dimension needed to break the scheme, the HAWK team conceded the attack and pulled the candidate, declaring that parameter fixes would render it uncompetitive. At almost the same moment the IETF SSH working group opened a call for adoption of pure and hybrid ML-DSA signature drafts, the mailing list filled with arguments over safety claims, AI-assisted cryptanalysis, and whether the community is moving too fast on primitives whose concrete security is still being rewritten by new tools.

The technical through-line is lattice reduction. Steve Weis announced an improved attack on HAWK-n that reduces key recovery to the shortest-vector problem in dimension n/2 + 1. In the gate-count model the cost of HAWK-512 falls from 2^150 to 2^108 and HAWK-1024 from 2^288 to 2^182; a practical implementation recovers a HAWK-256 secret key in hours on one server. Weis emphasized that the result leaves Falcon, ML-DSA and other lattice schemes untouched, and that the HAWK team had verified the finding. The striking claim was process: "this was found by Claude, with minimal technical guidance from people."

Daniel Apon replied simply "Nice. It checks out independently for me." The HAWK team itself confirmed the core arithmetic: "We confirm that their attack approximately halves the block size required in lattice reduction to recover (an equivalent) secret key." They added that naïve countermeasures, doubling parameters or moving to higher-rank modules, "make HAWK uncompetitive." Dustin Moody of NIST recorded the official withdrawal and thanked the team for its work throughout the on-ramp.

Human cryptanalysts reached essentially the same place by different routes and at far lower monetary cost. Guilhem Mureau and Alice Pellet-Mary reduced rank-2 module-LIP over a cyclotomic field to a norm-reduced principal-ideal problem in a quaternion algebra, then further to module-LIP of rank 3 over the maximal totally real subfield. The net effect is SVP calls in dimension at most 3n/4 + 1, matching an earlier result by Hengyi Luo. When Betül Durak asked about resources, Pellet-Mary answered that the work took roughly two months of part-time effort and "a safe upper bound on the cost would be 2 person*month," with no expensive tooling. Multiple independent mathematical paths therefore converged on the same fragility; the AI result simply arrived first and with a dramatic demonstration.

The episode sits inside a broader wave of AI claims in lattice theory. Cong Ling noted that OpenAI had announced a new upper bound of 0.604 on the sphere-packing density exponent, the first improvement on the Kabatiansky-Levenshtein bound of 0.599 since 1978, writing "AI has now also surpassed humans in lattice theory." Separate eprint papers claiming polynomial-time quantum algorithms for the dihedral coset problem prompted immediate proof-checking. Markku-Juhani O. Saarinen reported that central lemmas fail as written (randomness spent twice, unconditional hashing after heavy quantum conditioning), yet cautioned that "a bug in the proofs doesn't demonstrate that the algorithm itself doesn't work." Even a repaired result, the emerging consensus held, would remain asymptotically interesting but too expensive in concrete quantum resources to threaten NIST PQC parameter sets.

That mixture of genuine advance and unfinished proof landed inside an IETF process already under time pressure. Stephen Farrell opened a three-week call for adoption, asking the SSH working group to choose one hybrid draft and one pure ML-DSA draft as starting points, deliberately deferring algorithm combinations, sizes and SLH-DSA. Deirdre Connolly backed the pure ML-DSA draft, stating she wanted to use it "very much." Parallel threads, however, spilled into wider cryptanalytic anxiety. Commentaries on an AI-discovered attack on 7-round AES, notes by Orr Dunkelman and D. J. Bernstein, and renewed arguments over Grover's algorithm versus AES-128 produced long exchanges. Bas Westerbaan summarized the practical gap: many labs publicly target a cryptographically relevant quantum computer able to run Shor against RSA-2048, yet "there is not a single lab that has even dared to speculate on when they're able to break AES-128." Roger Grimes and John Preuß Mattsson revisited the decade-old conclusion that AES-128 remains out of reach for foreseeable gate speeds, while Ken Kubota and others still urged migration to 256-bit keys on the strength of national guidance and photonic-gate speculation.

The governance tension is therefore twofold. On the NIST side, an on-ramp candidate whose security rested on module lattice problems of modest rank proved brittle once new reduction techniques, whether human or AI-assisted, were applied; the only remaining options destroyed its performance advantage, so withdrawal was the rational response. On the IETF side, working-group chairs are trying to freeze protocol mechanics for ML-DSA in SSH while the surrounding literature continues to produce both solid attacks on sibling schemes and incomplete claims that still consume reviewer time. Proponents of rapid adoption argue that ML-DSA itself is untouched by the HAWK results and that hybrid constructions plus conservative parameter choices give deployers a workable path. Skeptics counter that the same accelerated timeline that produced HAWK's late discovery may still hide dimension-halving ideas applicable to other structured lattices, and that AI tools lower the cost of searching for them.

What remains unresolved is how evaluation processes should weight an AI-generated break that is later reproduced by classical mathematics, and whether protocol groups should slow adoption calls when the broader cryptanalytic environment is visibly in flux. HAWK is gone; ML-DSA drafts are advancing under a clock that ends in mid-August. The concrete security of the remaining candidates has not been shown to collapse, yet the cost and speed of discovering new lattice reductions have clearly changed. The community now has to decide, in public and under deadline, how much additional scrutiny that change demands before code points are assigned and implementations ship.