AI-Assisted Cryptanalysis of HAWK-256 and 7-Round AES-128

Technical Analysis

The HAWK attack leverages a previously unidentified symmetry in the underlying lattice structure of HAWK-256, enabling an end-to-end key-recovery attack with a reported runtime of approximately 3 hours 42 minutes on a 96-core server, indicating the flaw is practically exploitable rather than purely theoretical. The AES result targets a reduced 7-round variant of AES-128 (not the full 10-round cipher used in production systems), with the AI-assisted approach yielding a 200x to 800x speedup over prior known attacks, though full AES-128 remains unbroken. No CVE has been assigned as this is a cryptographic research finding rather than a software vulnerability in a specific product. The primary risk vector is to organizations that have adopted or are piloting HAWK as a post-quantum signature scheme in TLS, code-signing, or authentication infrastructure ahead of full standardization scrutiny. For AI agent systems, this development is relevant less as a direct exploit and more as an indicator that LLM-driven agents can be tasked with automated cryptanalysis workflows, meaning agent frameworks with tool-use or code-execution capabilities used in security research could be repurposed to accelerate discovery of weaknesses in cryptographic schemes protecting agent credentials, API keys, and signed model artifacts.

Affected Systems

Implementations and pilots of the HAWK-256 post-quantum digital signature scheme; research and legacy systems using reduced-round (7-round) AES-128 configurations; not applicable to full-round AES-128/192/256 as deployed in standard TLS, disk encryption, or VPNs

Indicators of Compromise

• Not applicable — this is a cryptographic research disclosure, no malware, C2 infrastructure, or exploit code artifacts identified

Remediation Steps

1. 1

   Audit PQC scheme adoption

   Identify any systems, pilots, or products using HAWK-256 for digital signatures and assess exposure to the disclosed lattice symmetry attack.

2. 2

   Delay/limit production use of HAWK

   Avoid deploying HAWK-256 in production authentication or code-signing systems until the scheme is patched, revised, or superseded by NIST-vetted alternatives (e.g., ML-DSA/Dilithium, SLH-DSA).

3. 3

   Monitor standardization bodies

   Track NIST and HAWK design team responses for parameter changes, patches, or scheme withdrawal recommendations.

4. 4

   Review reduced-round cipher usage

   Confirm no production systems rely on reduced-round AES variants; ensure full 10/12/14-round AES implementations are in use per standard.

5. 5

   Govern AI-assisted security research tooling

   If using LLM agents for internal cryptanalysis, fuzzing, or vulnerability research, apply strict sandboxing and output review given demonstrated capability for AI-accelerated attack discovery.