Attacks on Public-Key Cryptography

Anthropic's Claude model recovered keys from HAWK, a post-quantum signature candidate, in 60 hours at $100,000 cost, halving security from 2^64 to 2^38 operations. The attack forces HAWK to double key sizes to recover security, eliminating its efficiency advantage.

A malicious SSH server can trigger a use-after-free in OpenSSH clients before version 10.4 during host key re-exchange, allowing arbitrary code execution on the client. The fix is available in OpenSSH 10.4, released July 6.

CVE-2026-108266 in a TLS library for Remote Attestation in enclaves allows attackers with an enclave's private key to relay a legitimate quote to a different connection, tricking relying parties into accepting attacker-controlled connections as trusted enclaves. This affects confidential computing deployments.

Oratomic published research claiming a fault-tolerant quantum computer with about 10,000 atomic qubits could break widely used encryption, far lower than earlier estimates of millions of qubits. The claim has no independent verification and the machine does not yet exist.

The Hamming weight of ML-DSA signature hints correlates with the signing key's t0 norm with Pearson r of 0.95–0.98, allowing a single signature to identify its key among 200 with 1.5–1.8 times chance accuracy. After 1,300–3,700 signatures per key, statistical tests can determine whether signatures share a common key without the public key.

Researchers found a bug in the security proof of a lattice-based blind signature scheme from Crypto'20 and developed an attack exploiting correlations between tree leaves under honest-key and honest-but-curious-signer settings. The attack breaks the blindness notion of the scheme.

Researchers developed classical subexponential algorithms running in time 2^((1/2+o(1))n/ln ln n) that recover short secrets from Kyber/ML-KEM, FrodoKEM, SABER, NTRU LPRime, and Dilithium/ML-DSA with polynomial moduli and polylogarithmic coefficient scales. For NTRU and Falcon, affine slice search recovers equivalent signing keys in time 2^(O(n/ln ln n)), though these results do not reduce concrete security of currently specified parameter sets.

CVE-2026-54875 in OpenSSL 4.0, 3.6, 3.5, and 3.4 uses non-constant-time scalar multiplication for SM2 private key operations on ARM64 and RISC-V, leaking the secret scalar through execution time and cache-access patterns. An attacker measuring timing or observing cache lines can recover information about the long-term private key or per-signature nonce.

Researchers forged 1024-bit RSA signatures using extended Number Field Sieve, querying a raw RSA signing oracle about 2^32 times during 1,200 core-years of precomputation, then forging signatures offline in 180 core-years each—roughly 2,500–5,500 times faster than factoring. The attack requires temporary access to an unpadded RSA oracle; padded signatures and 2048-bit keys are not endangered.

Bouncy Castle for Java before version 1.86 leaked HQC private key information through cache-timing and decapsulation-timing side channels in its GF(2^8) lookup tables and fixed-weight sampler. This affects the NIST post-quantum cryptography candidate HQC and requires local access with specific preconditions to exploit.