Quantum computing is becoming an ever more pertinent threat to the security of the internet. Some predict that large quantum computers could arrive as early as 2030, placing the cryptography underpinning world banking, messaging, and cybersecurity at risk. Digital signatures use mathematical algorithms to confirm the source of a payment, message, or software update.
Without these assurances, the systems powering global connectivity and finance would cease to function. While this threat has only recently entered the mainstream public consciousness, the technology industry has preempted it for far longer.
The US National Institute of Standards and Technology (NIST) has spent almost a decade running open contests to develop post-quantum replacements for the current cryptographic standards. One of these is currently ongoing. In May this year, a shortlist of nine digital signature algorithms advanced to a third round of review, filing their final design changes on August 14.
Claude Mythos cracked HAWK, a leading post-quantum candidate
The critical nature of this work was further highlighted on July 28 when Anthropic published two papers claiming that Claude Mythos Preview - a non-public model available to security researchers through Project Glasswing - identified novel attack vectors in one of the cryptographic algorithms submitted for the contest.
The company framed this as a step up in the cybersecurity capabilities of its flagship model, which until now has only been able to identify errors made by programmers when implementing algorithms into their code. This is distinct from their most recent announcement, in which they claim Claude "is able to find mathematical flaws in the algorithms themselves."
One of the affected models was HAWK. This experimental signature scheme is the only one of the remaining NIST candidates built on lattices, a branch of geometry involving grids of points in hundreds of dimensions. This makes it among the most memory-efficient examples, with signatures running on as little as 555 bytes using its lowest security settings.
However, according to academic work published last year, such a scheme is prone to vulnerabilities based on symmetries hidden in its lattice, which would cut the problem of key recovery roughly in half. This was a purely hypothetical concern, until Claude Mythos Preview unearthed just such a symmetry in HAWK-256.
This configuration of the HAWK cryptographic standard is published by its developers for the purposes of public stress-testing. By having their model identify this vulnerability, Anthropic cut the number of operations required to steal a secret key from 18 quintillion to 275 billion.
The cost of initially cracking the HAWK-256 secret key was significant. Anthropic’s experiment incurred a compute cost of approximately $100,000 and took around 60 hours. However, now that it has identified the viability of the method, subsequent recovery operations will take less than four hours on a 96-core server.
HAWK is retired, but AES remains untouched
It’s important to reiterate that HAWK-256 is an intentionally weaker configuration than those presented to NIST. HAWK-512 and HAWK-1024 likewise see their estimated attack cost drop, but their remaining security margin still places them well above the current capabilities of any attacker. Still, restoring them to their original security margin would mean doubling the size of the keys and thereby sacrificing their edge in compactness.
As a result, the developers behind HAWK have since withdrawn it from consideration. Sophie Schmieg, a researcher in post-quantum computing at Google, has since declared that “Basically with this paper, HAWK is dead.”
At the same time as its HAWK announcement, Anthropic revealed that it had identified vulnerabilities in a second cryptographic standard: AES, the live cipher currently protecting most encrypted traffic. Anthropic claims to have sped up the previous best attack by 200 to 800 times, but with several mitigating factors.
The first is that their attack targeted a stripped-down, seven-round research version rather than the full ten-round cipher. It also assumed that an attacker could obtain roughly 400 octillion specially chosen messages encrypted under the same key. Because of this apparent infeasibility, Anthropic did not carry out the full attack, instead computationally verifying only parts of it and extrapolating the end result.
As a result, this second finding is materially less significant than the first, which put a previously promising post-quantum signature candidate out of commission.