Post-quantum TLS ships while lattice schemes crack under AI and process fights

The post-quantum migration is no longer a research timeline. It is a collision between shipping code and unfinished cryptanalysis. In the same stretch of weeks, the IETF published hybrid ML-KEM key agreement for TLS 1.3 as a Proposed Standard, a pure-ML-KEM TLS draft entered last call under loud objections from D. J. Bernstein, and the HAWK signature candidate was withdrawn from NIST’s additional signatures round after an AI-assisted lattice attack roughly halved the dimension of the hard problem it rested on. The through-line is not that post-quantum cryptography is failing. It is that confidence, cost, and process are being stress-tested at the same time deployment pressure peaks.

HAWK’s exit was unusually clean. Steve Weis announced an improved key recovery against HAWK-n that “reduces to SVP in dimension n/2 + 1,” cutting estimated key-recovery cost for HAWK-512 from 2^150 to 2^108 and for HAWK-1024 from 2^288 to 2^182 in the AGPS gate-count model, with a practical end-to-end recovery of a HAWK-256 key in hours on one server. The note that landed hardest was methodological: “this was found by Claude, with minimal technical guidance from people.” Daniel Apon’s reply was blunt verification, not hype: “Nice. It checks out independently for me.”

The HAWK team did not argue the math away. They confirmed that the attack “approximately halves the block size required in lattice reduction to recover (an equivalent) secret key,” and that “Naïve approaches to circumvent this, such as doubling parameters or moving to higher rank modules, make HAWK uncompetitive.” Withdrawal followed. NIST’s Dustin Moody updated the round-three on-ramp page and thanked the team. Parallel human work made the result look less like a one-off lab curiosity. Guilhem Mureau and Alice Pellet-Mary described a third key-recovery line, via rank-2 module-LIP reductions through quaternion algebras down to module-LIP over the maximal totally real subfield, yielding SVP calls in dimension at most 3n/4+1: “very similar” in effect to other recent breaks, produced in roughly “2 person*month” of ordinary research time. Lattice-based KEMs and signatures already standardized or still standing, including Falcon and ML-DSA, were explicitly said not to be hit by the Anthropic result. Still, a signature scheme that looked viable enough to ride an on-ramp was gone once the dimension collapsed.

That episode sits inside a wider, noisier moment for lattice and related hardness assumptions. Cong Ling flagged OpenAI’s claimed improvement of the sphere-packing density exponent upper bound to 0.604, the first movement past Kabatiansky-Levenshtein 0.599 since 1978, as AI “surpassed humans in lattice theory.” Separately, a claimed polynomial-time quantum algorithm for the Dihedral Coset Problem drew immediate proof skepticism. Markku-Juhani O. Saarinen reported that direct checks fail as stated: “Lemma 3's central independence claim doesn't work as stated (it spends randomness in D twice), and Lemma 4 applies unconditional hashing bounds after heavy quantum conditioning.” He stressed the cryptanalytic distinction that matters for standards bodies: a broken writeup is not yet a broken algorithm, and even a repaired asymptotic result would, by current consensus, leave NIST PQC concrete security claims intact because resource costs stay too high. The community pattern is familiar and uncomfortable. Tools accelerate discovery and draft proofs; humans still have to decide what survives parameter choices and deployment.

Against that backdrop, the IETF moved metal. RFC 10024, Post-Quantum Traditional (PQ/T) Hybrid Key Agreement Mechanisms for TLS 1.3, is a Proposed Standard. Authored by Kwiatkowski, Kampanakis, Westerbaan, and Stebila, it defines three hybrids: X25519MLKEM768, SecP256r1MLKEM768, and SecP384r1MLKEM1024. Each couples ML-KEM with an ephemeral elliptic-curve Diffie-Hellman exchange so that session secrets should remain secure if either the PQ or the classical component holds. Sean Turner’s one-line reaction on the TLS list captured the operational mood: “Congrats to all those who worked on this!” Hybrids are the conservative engineering answer to exactly the HAWK-class fear: new mathematics can still move under you, so keep a classical floor while the PQ piece matures in the field.

Pure ML-KEM in TLS is a different political and technical fight. The IESG last-called draft-ietf-tls-mlkem as Informational, registering ML-KEM-512, ML-KEM-768, and ML-KEM-1024 as NamedGroups for TLS 1.3. Bernstein objected on process as well as substance. Pointing at a chair report that said details of “past appeals and mailing list conflicts” would go privately to the responsible AD, he wrote that “This secrecy violates RFC 2026, Section 8,” which requires publicly accessible records of written contributions that pertain to standards-related activity, and demanded that chairs, ADs, and IESG post what was filed. Cost and security arguments have traveled with that process critique for years in his public writing: ciphertext and key sizes, CPU and memory pressure on constrained and high-volume endpoints, and the risk of freezing a single lattice family too early.

Defenders of publishing the pure code points separate preference from protocol mechanics. Sophie Schmieg argued that transcript binding means “client and server will always either get their preferred key exchange algorithm or fail the exchange,” so standardizing pure ML-KEM “does not impact anyone who does not specifically and against recommendations set up their client and server to actually negotiate the pure key exchange.” On her telling, “this is not a question on which key exchange algorithm is more secure, or more efficient, or has a brighter hue of blue coloration” beyond the recommendation text. Side debates about whether ML-KEM’s randomness handling “violates” TLS 1.3’s key schedule drew corrections from David Benjamin and Muhammad Usama Sardar: the TLS 1.3 main secret is not the TLS 1.2-style primary handshake output, derived secrets incorporate the transcript, and formal work on the 1.3 schedule remains the relevant reference, not diagrams that collapse those distinctions.

What stands is a split posture. Hybrid ML-KEM ECDHE is now an Internet Standards Track fact operators can cite. Pure ML-KEM code points are moving through last call under unresolved process complaints and a live argument about whether optionality without hybrid safety nets is responsible. NIST’s signature on-ramp lost HAWK to an attack that compressed lattice dimension and was found with heavy AI assistance, while other lattice standards were left standing and a splashy quantum-claim paper drew proof bugs rather than panic. Unresolved is how much cryptanalytic surprise the community is willing to absorb after code points ship, how transparent appeal records must be when chairs declare rough consensus, and whether AI-accelerated breaks become a steady tax on every remaining structured-lattice design or a one-time shock that mainly weeds out the fragile. Deployment is no longer waiting for that answer.