HAWK is no longer a candidate for NIST standardization.
The team that developed this signature algorithm has withdrawn it from the competition. Behind the move lies the discovery of a mathematical weakness that reduces the “effective” key size by nearly half. It exploits a symmetry—known as an automorphism—in the lattice network, enabling faster enumeration.
Claude Mythos spent roughly 60 hours—and about $100,000 in API costs—to develop an end-to-end attack. An experienced researcher in computer theory—but not a cryptography expert—led the “project management,” for instance guiding the model on how to track ideas or which libraries to use.
Anthropic provides a reference implementation, with a single command and checkpoints. It enables retrieving an HAWK-256 key in just under 4 hours on a 96-core Sapphire Rapids server.
A naïve approach would be to use keys twice as long to compensate for this vulnerability. However, that would make the algorithm far less competitive. As it stands, generating and verifying HAWK-512 signatures is expected to take under 0.1 ms on a standard desktop PC. The memory-optimized implementation consumes 14 kiB of RAM.
Related reading:
Some French approaches to kick-start the post-quantum transition
In practice, GPG and OpenPGP are advancing separately on post-quantum cryptography
How Anthropic moved from Claude Mythos to Claude Fable
