摘要 · Summary
Cryptography · AI Capability · Research BriefAnthropic · published 28 Jul 2026 · read 29 Jul
Executive summary · one-page brief
Read the Papers, Not the Blog
An unreleased Anthropic model produced two genuine cryptanalytic results — an improved key-recovery reduction against the HAWK post-quantum signature scheme, and a runtime improvement on 7-round AES-128. Both are real; neither threatens a deployed system, and neither was ever claimed to. The story is the gap between the announcement and Anthropic's own papers, and it runs both ways: on AES the blog quotes the flattering column, while on HAWK it omits the one finding that would actually matter to NIST.
By the Numbers four figures, kept honest
- 200–800×the blog's headline — the time column only, at a data budget of 2^105 chosen plaintexts that never moves
- 2.7 bitsthe same result on max(D,T,M), the figure of merit the field ranks attacks by — a 6.5× gain
- 35–62 bitshow far HAWK-512 now appears to fall below its NIST category-1 target
- ~$100kAPI cost per result — excluding the hundreds of expert hours that do not scale
Claimed vs Stated blog line · what the paper says
| Result | The announcement says | The paper says |
|---|---|---|
| AES-128, 7 rounds | "between 200 and 800 times faster" | 2.7-bit improvement on max(D,T,M); data complexity unchanged at 2^105 |
| HAWK-512 | "effective keysize reduced by a factor of two" | 2^150 → 2^108 gates provable, ~2^80.8 heuristic — below NIST category 1, never stated in the blog |
| Discovery | "discovered completely autonomously" | autonomous in the mathematics only — three days of prompting, then hundreds of hours of expert validation |
| Cost | "roughly $100,000 in API cost" per result | plus hundreds of hours of senior validation — the term that does not scale, and the failed runs are not counted |
The Economics, Which Is the Real Finding compute is cheap · attention is not
Anthropic puts each result at roughly $100,000 in API cost — about one postdoc-year of budget at a European crypto group, for work that historically takes such a group months to years. But that figure excludes the largest human cost: hundreds of hours of senior validation, itself perhaps $30k–$60k of skilled labour, and the part that does not scale. Anthropic's own framing is that its researchers were "bottlenecked on studying and validating these results." On CryptanalysisBench, released eight days earlier, the same model scores 85.7% against known-broken schemes and 8.9% against full-strength ones — which is the honest measure of where the capability actually sits.
- ~60 hrsto find, develop and verify the HAWK result
- 1B tokensoutput tokens — $25k–$50k at published list rates
Bottom line
Two real contributions, produced in days rather than years and reviewed before publication by the authors of the prior art — Derbez, Jean, Dunkelman, Keller, Ronen and Adi Shamir. The people best placed to reject them did not.
Reframe
What changed is not the security of AES or the fate of HAWK. It is the cost of producing a publishable cryptanalytic result — and the fact that the scarce resource is now expert attention to check such results, not expertise to produce them.
起承 · Context · Content 1 / 2
起 — Two Results, One Announcement what was actually published
AES-128 · 7 of 10 rounds
The Möbius Bridge
- The S-box is inversion in GF(2^8) plus an affine map; composed with an unknown key byte the whole thing is a Möbius transformation.
- A fingerprint invariant under it removes one of nine guessed key bytes — 256× fewer guesses, minus the transform's own cost.
- First improvement on 7-round AES-128 in about a decade. Full 10-round AES is untouched.
- It has never been run and cannot be — 2^89 time. Confidence rests on scaled-down experiments and human review.
- Data complexity is unchanged: 2^105 chosen plaintexts is 4.06×10^31 — 40,560 octillion, a figure some coverage rendered as 400 octillion, off by ~100×.
HAWK · NIST additional signatures, round 3
SVP in Half the Dimension
- Key recovery reduces to poly(n) exact-SVP calls in dimension n/2+1, via the Galois involution ζ ↦ −ζ.
- Two real HAWK-256 keys recovered end to end in hours, sign/verify checked against the official submission package.
- But HAWK-256 is an explicit challenge parameter set — a deliberately weak target, not a NIST security level.
- Does not transfer to Falcon; conductors m ∈ {p^k, 2p^k} for odd prime p evade it entirely.
- Its disclosure is the hedged one: "AI-assisted… human contribution mainly consisted of directing, organizing and verifying" — where the AES paper says "completely autonomously".
承 — Keep the Three Axes Apart data · time · memory
| 7-round AES-128 attack | Data (D) | Time (T) | Memory (M) | max(D,T,M) |
|---|---|---|---|---|
| DKS10 (2010) | — | 2^116 | 2^127 | 2^116 |
| DFJ13 — the compared point | 2^105 | 2^99 | 2^90 | 2^105 |
| DFJ13 — balanced | 2^97 | 2^99 | 2^98 | 2^99 |
| This work — at fixed D | 2^105 | 2^89.3–2^91.4 | ~2^90 | 2^105 |
| This work — balanced | 2^96.1 | 2^96.3 | 2^96.1 | 2^96.3 |
The 200–800× is the time column and nothing else: 2^99 ÷ 2^91.4 = 194 and 2^99 ÷ 2^89.3 = 832, at a data budget that does not move. Anthropic's own paper states the same result on the metric the field ranks by — max(D,T,M) improves by 2.7 bits, or 2.1 bits once the fingerprint-randomness assumption is dropped. This is selective emphasis, not fabrication: the paper supplies the unflattering number itself. Round-reduced cryptanalysis is a legitimate, mainstream and crowded genre — attacking 7 of 10 rounds is how the field measures AES's security margin, not a claim about deployed AES, whose best attack still beats brute force by about two bits.
- 256×fewer key-byte guesses — one of nine eliminated
- 2^19 → 2^8.6per-entry lookups — the engineering that makes it pay
One Step Every Three to Five Years the lineage this result joins
- 2008Demirci–Selçuk introduce the parameter-table meet-in-the-middle attack — at 2^200 entries.
- 2010Dunkelman–Keller–Shamir add the multiset fingerprint and differential enumeration, cutting the table to 2^127: the first 7-round AES-128 attack below exhaustive search, at 2^116.
- 2013Derbez–Fouque–Jean tighten to ten parameter bytes and rebalance the differential: 2^105 data, 2^99 time, 2^90 storage.
- 2026The Möbius Bridge cuts time to 2^89.3–2^91.4 — the first advance in about a decade, and the first produced by a model rather than a group.
轉合 · Pivot & Resolution · Content 2 / 2
轉 — What the Announcement Leaves Out HAWK Table 1, costs per SVP-oracle call
| Parameter set | BKZ blocksize | Core-SVP spec → attack | AGPS20 gates spec → attack |
|---|---|---|---|
| HAWK-256 — challenge set | 211 → 129 | 2^62 → 2^38 | 2^74 → 2^52 |
| HAWK-512 — NIST category 1 | 452 → 257 | 2^132 → 2^75 | 2^141 → 2^86 |
| HAWK-1024 | 940 → 513 | 2^274 → 2^150 | 2^278 → 2^158 |
"Effective keysize halved" and "2^64 → 2^38" are both true and are different rows of this table: the halving is of the security exponent (80.8/150 = 0.539; 146.5/288 = 0.509), because the oracle dimension drops from n to n/2+1. The consequence the blog never states is arithmetic: NIST category 1 is anchored at roughly 2^143 classical gates, and HAWK-512 now lands 35 bits below it on the provable bound and 62 bits below on the heuristic estimate. Nothing here is a practical break — 2^81 gates is still on the order of 10^24 operations — but for a NIST candidate, missing your own category is the finding that gets you re-parameterised. One mismatch remains unresolved: the blog says 2^64 where the paper's table says 2^62.
- 35 bitsprovable shortfall vs NIST category 1
- 62 bitsheuristic shortfall — the buried lede
HAWK Was Already Under Attack which cuts both ways
- 2026At least four independent HAWK cryptanalysis eprints — 2026/699, 1298, 1318 and 1377. The scheme was under active human attack, not neglected.
- 25 JunAn Imperial College team claims a probabilistic polynomial-time HAWK key recovery (ePrint 2026/1318), contingent on four heuristics — while explicitly not claiming HAWK is broken.
- JunAnthropic notifies the HAWK team privately. Thomas Pornin and colleagues later review the paper, pressing on attribution for components drawn from prior work.
- JulSaarinen rebuts (ePrint 2026/1377): the guessing game is not polynomial-time. The Imperial claim is retracted on revision — a human result that collapsed in weeks.
- 28 JulBoth papers published; Weis posts to the NIST pqc-forum. Daniel Apon replies within hours that the result checked out independently for him, and calls for a community standard for adjudicating AI-generated cryptanalytic claims.
The Honest Balance stronger than framed · weaker than framed
| Dimension | Stronger than framed | Weaker than framed |
|---|---|---|
| Review | Derbez, Jean, Dunkelman, Keller, Ronen and Adi Shamir read the AES draft; the HAWK team read the HAWK paper. | "Years of expert review missed this" is press framing: HAWK drew at least four independent cryptanalysis eprints in 2026 alone. |
| Evidence | The HAWK reduction is unconditional and deterministic, and ships Apache-2.0 code that recovers real keys. | The AES attack can never be run; no independent replication exists; neither paper is on IACR ePrint. |
| Magnitude | HAWK-512 may no longer meet the security category it was submitted under — the result that matters most. | The only end-to-end key recovery is on HAWK-256, an explicit challenge parameter set, not a NIST level. |
| Independence | CryptanalysisBench was public eight days before the blog, with academic co-authors and open code. | Its co-authors overlap the paper's reviewers and authors; no HAWK-team or NIST statement was found at T+1 day. |
合 — Where it lands
A contribution of the type and quality a strong human group produces every few years, delivered in about three days of wall clock and not rejected by the field's leading practitioners. The novelty is the production function, not the result.
What to watch
Whether NIST or the HAWK team respond to the category-1 shortfall; whether either paper reaches IACR ePrint, the venue that would trigger real adjudication; and whether a community standard emerges for judging AI-generated cryptanalytic claims, as Daniel Apon has called for.