HAWK Withdrawn from NIST’s Post-Quantum Signature Competition

The team behind the HAWK post-quantum digital signature algorithm has withdrawn it from NIST’s Additional Digital Signatures standardization process following the disclosure of a major key-recovery attack.

The attack substantially reduced HAWK’s estimated security margin. Although the full proposed parameter sets were not shown to be immediately breakable on ordinary hardware, restoring their intended security would have required significantly larger parameters. The HAWK team concluded that those changes would eliminate the advantages that made the algorithm competitive.

This is an important development, but it is also evidence that NIST’s public cryptographic review process is working as intended.

What Was HAWK?

HAWK was a lattice-based, hash-and-sign digital signature scheme submitted to NIST as a possible additional post-quantum signature standard.

It was designed to provide compact signatures while avoiding some of the implementation complexity associated with other lattice-based signature systems. In May 2026, NIST advanced HAWK and eight other candidates to Round 3 of its Additional Digital Signatures process.

Only a little more than two months later, new cryptanalysis changed HAWK’s outlook.

What Did the Attack Find?

Researchers discovered previously unrecognized mathematical structure in HAWK that allowed key recovery to be reduced to a lower-dimensional Shortest Vector Problem, or SVP.

The effective lattice dimension was reduced to approximately:

n / 2 + 1

Because lattice-reduction costs grow rapidly with dimension, this significantly lowered the estimated effort required to attack HAWK.

Researchers also demonstrated an end-to-end attack against the smaller experimental HAWK-256 parameter set, recovering equivalent signing material in a matter of hours on a single server.

The attack did not recover the original secret seed, but it recovered enough secret information to produce valid signatures. From a security perspective, this still represents a successful key-recovery attack.

Why Was HAWK Withdrawn?

The HAWK team reviewed and confirmed the central result.

Potential mitigations included increasing parameter sizes, doubling dimensions, or redesigning the construction around higher-rank modules. Those changes, however, would have increased key sizes, signature sizes, and computational costs.

The team determined that a hardened version of HAWK would no longer provide enough advantage over competing algorithms and voluntarily withdrew the submission.

NIST did not independently disqualify HAWK. The submission team withdrew it after confirming that the attack undermined its competitiveness.

Does This Affect Other NIST PQC Standards?

No evidence indicates that the attack applies broadly to lattice-based cryptography.

The weakness was tied to mathematical structure specific to HAWK. It does not invalidate:

• ML-KEM, standardized in FIPS 203
• ML-DSA, standardized in FIPS 204
• SLH-DSA, standardized in FIPS 205
• Falcon or the developing FN-DSA standard
• Post-quantum cryptography as a whole

Organizations should not interpret the HAWK withdrawal as a reason to delay migration to NIST-standardized post-quantum algorithms.

Why This Is Good for the NIST Process

HAWK was still a candidate. It had not become a FIPS standard or an approved foundation for federal deployments.

The sequence was exactly what a public cryptographic competition should produce:

1. NIST advanced a promising candidate.
2. Researchers continued analyzing it.
3. A stronger attack was discovered.
4. The result was reproduced and reviewed.
5. The designers confirmed the issue.
6. The algorithm was withdrawn before standardization.

Cryptographic competitions are not successful because every candidate survives. They are successful when weaknesses are identified before algorithms become embedded in products, protocols, and critical infrastructure.

Lessons for PQC Migration

The HAWK withdrawal reinforces three practical lessons.

First, organizations should distinguish between experimental candidates and finalized standards. Competition candidates should not be deployed as though they already carry NIST approval.

Second, systems should support cryptographic agility. Algorithms, parameter sets, certificate formats, and protocol integrations must be replaceable without redesigning an entire platform.

Third, organizations need an accurate inventory of their cryptographic dependencies. A cryptographic bill of materials can help identify where experimental, deprecated, or newly weakened algorithms are present.

Conclusion

HAWK’s withdrawal is significant, but it is not a failure of the NIST process.

A previously unknown structural weakness reduced the algorithm’s expected security. The research was disclosed, reviewed, and confirmed. The HAWK team then withdrew the candidate before it could become a federal standard.

That is cryptographic standardization working as intended: weaknesses are found publicly, promising designs are challenged, and only the strongest candidates move forward.