Mythos Attack Uncovers Years-Long Unknown Vulnerabilities in Post-Quantum Cryptography

As Ars Technica reports (https://arstechnica.com/security/2026/07/mythos-uncovers-crypto-weaknesses-that-went-unknown-for-years/), a research team has discovered a serious vulnerability in the post-quantum cryptography algorithm HAWK using the so-called Mythos attack. This algorithm had been considered robust and was a candidate in the third round of standardization by NIST (National Institute of Standards and Technology).

Background on HAWK and Post-Quantum Cryptography

Post-quantum cryptography (PQC) aims to develop cryptographic methods that remain resistant to attacks by quantum computers. Since quantum computers could potentially break classical encryptions like RSA or ECC in the future, developing secure PQC algorithms is crucial for IT security. HAWK was one of the promising candidates that withstood extensive testing and analysis over many years. However, the discovery of the Mythos attack now calls the security of this algorithm into question.

Discovery of the Mythos Attack

The Mythos attack exploits a previously unknown weakness in the mathematical structure of HAWK. According to the researchers, the attack allows secret keys to be reconstructed with significantly less effort than previously assumed. This finding was surprising because HAWK had been considered secure for years and no such vulnerabilities had been revealed in multiple security tests. The analysis shows that while the attack’s complexity remains high, it is considerably reduced compared to the assumed security parameters. This means attackers with sufficient resources could pose real threats to systems based on HAWK in the future.

Impact on Standardization and IT Security

The discovery has immediate consequences for the ongoing standardization of PQC algorithms. NIST had included HAWK as a candidate in the third round, but the Mythos attack has led to the algorithm being excluded from the selection process. For companies and organizations already using or planning to use HAWK, the vulnerability means they must reconsider their cryptographic strategies. The search for secure alternatives among PQC candidates becomes more urgent.

Why It Matters

The security of digital communication increasingly depends on resilience against future quantum attacks. The Mythos discovery shows that even seemingly well-tested algorithms can still harbor vulnerabilities. This underscores the need for continuous research and review in cryptography. Furthermore, the revelation affects projects relying on post-quantum cryptography, such as blockchain infrastructures or secure communication platforms. For example, the -project discusses long-term security strategies in the context of infrastructure that also include post-quantum resistant methods. Such projects must closely monitor developments to protect their systems against new attack methods.

Outlook

The cryptography community is already responding with intensive analyses and the search for more robust algorithms. PQC standardization will continue to evolve, with security and practical applicability remaining central. The Mythos discovery is a wake-up call that the post-quantum era, despite progress, still holds challenges. For users and developers, this means they cannot rely on supposedly secure solutions but must stay up to date with the latest research to make their systems future-proof.