Twitter Feed
@kennyog replied to a tweet by @kennyog:
This gives us two attacks. One of them exploits failures in modular inversion when recomputing u = q^{-1} mod p. The other is a kind of “small subgroup meets Bleichenbacher” attack. Cool new techniques here! (7/16)