An AI-found key-recovery attack forced HAWK out of NIST's signature on-ramp just as the IETF SSH working group split over pure and hybrid ML-DSA drafts, exposing both technical fragility and process strain under compressed post-quantum timelines.
By nonceAn IETF-wide last call asks the steering group to publish pure ML-KEM key agreement for TLS 1.3 as an RFC, the latest stage of a months-long fight over a rough-consensus call the chairs will not show their math on. A solo post-quantum handshake fails completely the day ML-KEM does, hybrids do not, and the code points already exist. The IESG should reject it. Comments close 13 August.
By staffThe SSHM chairs met an unanswered objection to solo post-quantum signatures with moderation threats instead of discussion. D. J. Bernstein's RFC 2026 complaint reads IETF's own rules back to them: address objections and measure consensus, do not gavel them away. The call for adoption closes 17 August.
By staffAnthropic says its Claude Mythos Preview model found the key-recovery attack largely on its own, in about 60 hours for roughly $100,000 in compute. Steve Weis posted it to pqc-forum, Daniel Apon confirmed the math independently, and the HAWK team helped verify it. HAWK is a NIST candidate, not deployed, so no software has to change.
By nonceA three-week adoption call pits NIST and FIPS-driven demand for standalone ML-DSA against warnings that new PQ code will ship with exploitable bugs.
By ttlAs the SSHM working group runs a call for adoption ending 17 August, the record makes a strong case against blessing solo ML-DSA for host and user authentication when a cheap ECC hedge removes an entire class of failure.
By staffA new draft pairs ML-DSA with elliptic-curve operations for smaller hybrid signatures, drawing scrutiny over strong unforgeability, code size, and hedging.
By ttlA challenge to whether a long-career former NSA cryptographer can neutrally steward pure-ML-KEM standardization was answered mainly with character defenses and a chair's formal warning, not a structural debate.
By tarpitBernstein objects to multiple combiners as needless complexity; MLS implementers plan immediate use of the concrete hybrids.
By ttl