NIST's Round-Three Signature Field Lost HAWK. Lineage Needs the Agility.

On May 14, 2026, NIST advanced nine candidates to the third round of its standardization process for additional post-quantum digital signatures: FAEST, HAWK, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign, and UOV. Eight remain. On July 29, 2026, the HAWK submission team withdrew the scheme after a key-recovery attack cut the expected work factor against HAWK-256 from 2^64 to 2^38, and NIST now lists HAWK as withdrawn.

The status report on the second round, NIST IR 8610, set the criteria. The third-round evaluation is expected to run roughly two years and to permit technical updates from the submission teams. HAWK's removal ten weeks into that window is the practical argument for everything that follows.

Most post-quantum coverage tracks key encapsulation. FIPS 203 standardized ML-KEM, and the migration conversation in federal and regulated environments centers on protecting data in transit and at rest against harvest-now-decrypt-later collection. That work matters. It is also only half of the cryptographic surface. The other half is signatures, and signatures are the data provenance problem.

Why the signature track is the provenance and lineage problem

A signature is what makes a record of the past verifiable in the future. Every Merkle-tree lineage entry is a signed claim about what happened to a data object. Every policy decision record at a policy enforcement point is a signed assertion about who was granted access, under what attributes, in what window. The integrity of a provenance system is the integrity of its signatures over the lifetime of the data, which for regulated records is measured in decades.

NIST already standardized two signature schemes, ML-DSA in FIPS 204 and SLH-DSA in FIPS 205. The additional signatures effort exists because a provenance system that depends on a single mathematical family carries concentration risk. ML-DSA is lattice-based. The round-three field deliberately diversifies the base, with multivariate "onramp" schemes such as SNOVA, MAYO, QR-UOV, and UOV producing compact signatures near one kilobyte, and isogeny and other constructions covering different assumptions. A break in one family should not invalidate a decade of signed lineage.

HAWK made that abstraction concrete inside a single quarter. The attack, published on July 28, 2026 by an Anthropic AI system, exploited a previously unused symmetry in the lattice construction behind HAWK-256 and shipped with technical papers and reproducibility artifacts. The submission team withdrew the scheme the following day, stating that straightforward mitigations would leave HAWK uncompetitive. Concentration risk is not a hypothetical about the 2030s. A candidate that cleared two rounds of public review fell in a day.

Signature agility belongs at the enforcement point, not in the application

The migration lesson from key encapsulation applies directly to signatures. An architecture that embeds a signature algorithm in application code carries a portfolio-scale rewrite when the algorithm changes. An architecture that concentrates the signing and verification operation at a single enforcement point converts an algorithm change into a configuration change.

Lattix Technologies anchors Merkle-tree lineage in content-addressed storage (CAS-X) and signs lineage entries and policy decisions at the policy enforcement point. Because the signing operation lives at the enforcement point rather than in each application, the lineage chain can adopt a new signature algorithm without re-signing history. The chain remains verifiable under the algorithm in force when each entry was written, and new entries adopt the current algorithm. Signature agility is a property of where the operation runs, not of the algorithm chosen on any given day.

What organizations building provenance systems should do now

Organizations standing up data provenance and lineage systems in 2026 should treat signature agility as a first-class requirement, not a future migration. The relevant question for any provenance architecture is whether a signature-algorithm change requires re-signing the historical chain. If it does, the system has bound its long-term integrity to a single algorithm whose standardization is still two years from resolution.

The additional signatures process is a signal that NIST expects the signature base to evolve, and the HAWK withdrawal is evidence that the evolution will not wait for a convenient migration window. A provenance system designed around that expectation, with the signing operation concentrated at the enforcement point and the lineage chain able to carry mixed algorithms across its history, is the system that survives the standard NIST has not yet named. The key encapsulation migration taught the discipline. The signature track is where the discipline pays off over the lifetime of the record.

References

• NIST, Post-Quantum Cryptography: Additional Digital Signature Schemes
• NIST, Round 3 Additional Signatures, listing HAWK as withdrawn
• NIST IR 8610, Status Report on the Second Round of the Additional Digital Signature Schemes
• NIST FIPS 204, Module-Lattice-Based Digital Signature Standard (ML-DSA)
• NIST FIPS 205, Stateless Hash-Based Digital Signature Standard (SLH-DSA)
• NIST FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM)
• Lattix, Post-Quantum Cryptography: Why the Transition Has to Happen Now