HAWK key recovery, GnuPG replies, cloud disclosure proposal

Post-quantum signature security and OpenPGP tooling drew the bulk of attention, with a separate call for better cloud infrastructure disclosure channels. The HAWK result stands out for its concrete impact on a candidate scheme.

HAWK key recovery reduced to SVP in dimension n/2 + 1

Anthropic researchers announced a key-recovery attack on HAWK that reduces the cost to solving SVP in dimension n/2 + 1. The work includes a practical break of HAWK-256. Readers tracking post-quantum signature candidates will need to weigh the revised hardness assumptions.

GnuPG maintainers respond to gpg.fail retrospective

GnuPG maintainers replied on oss-security to the gpg.fail authors regarding claimed remote code execution, a printf bug, and broader PGP format problems. The exchange addresses the technical merits and severity of the reports. OpenPGP implementers and packagers should note the maintainers' clarifications.

Predisclosure list proposed for cloud providers

A proposal on oss-security calls for a predisclosure list serving cloud and VPS providers that handle VM escape issues. Such operators currently fall outside the distros list. Coordinated notice could improve response times for infrastructure-level flaws.