Pith. sign in

REVIEW 5 major objections 6 minor 20 references

Rubber Mallet: A Study of High Frequency Localized Bit Flips and Their Impact on Security

T0 review · 5 major / 6 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read High-frequency adjacent bit flips from Rowhammer enable ECDSA key recovery and LLM guardrail bypass.

desk verdict The paper's central claim of significantly higher adjacent bit flip frequency is contradicted by its own Table 1; the tokenizer attack idea is novel but the downstream attacks are only theoretical. read the letter →

arxiv 2505.01518 v2 pith:QHCPPPFG submitted 2025-05-02 cs.CR

Andrew Adiletta , Zane Weissman , Fatemeh Khojasteh Dana , Berk Sunar , Shahin Tajik This is my paper · ORCID
classification cs.CR
keywords RowhammeradjacentbitflipsDRAMTRRbypassECDSAkeyrecoverylatticeattackLLMtokenizerfaultinjection
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper reports that TRR-bypassing Rowhammer attacks produce closely spaced multi-bit errors, not just isolated flips. Across roughly 100 MB of profiled memory, flips cluster within a row, and two-bit events in a byte land on adjacent positions about a quarter of the time—matching the combinatorial baseline—so the correlation is a real, modelable phenomenon. The paper argues these localized errors change the security calculus in two ways. A two-adjacent-bit flip in an ECDSA nonce changes it by a predictable signed value, and with two leaked nonce bits per signature the bounded-distance-decoding-with-predicate lattice method can recover OpenSSL private keys from a few hundred signatures. A one- or two-bit flip in a GGUF tokenizer dictionary can swap a safety-critical token, such as turning the refusal-related word 'make' into 'lake' in a system prompt, bypassing LLM guardrails without altering weights or inputs. If correct, the central message is that single-bit assumptions are too narrow for evaluating Rowhammer defenses.

What carries the argument

The carrying object is the adjacent two-bit flip and its arithmetic fingerprint. In software, positions i and i+1 flipping together produce a signed delta of ±3·2^i (both bits change from 0 to 1 or 1 to 0), so an attacker who sees the faulty signature can relate the fault to the two original nonce bits. The companion machinery is the bounded-distance decoding with predicate lattice solver, which turns roughly two adjacent leaked bits per signature into a full ECDSA key recovery with a few hundred signatures. For the LLM attack, the machinery is the tokenizer dictionary: a compact, deterministically addressed table in the GGUF file whose ASCII strings differ by single bits (e.g., 'l' vs 'm'), so a flip rewrites token meaning. The paper also supplies a combinatorial null model—the probability that k flips in an 8-bit byte are adjacent is (n-k+1)/C(n,k)—to show multi-bit events are well described by chance within a byte while row-level clustering deviates from random.

What would settle it

A concrete observation that would settle the central claim: profile the same DRAM with a known address-to-cell mapping (or after disabling swizzle where possible) and check whether the pairs of bits that flip together at logical positions i and i+1 sit in physically neighboring cells. If the correlated pairs scatter to non-neighboring physical cells, the paper's physical-clustering explanation, and the defense implications built on it, lose their foundation; the logical pattern alone would remain observable but would need a different explanation.

Watch

Extended reading notes

Core claim

This paper argues that advanced Rowhammer hammering—specifically the many-sided and frequency-based patterns that defeat target-row refresh—does not produce isolated random bit errors. It produces localized clusters: flips are likelier near other flips within a row, and when two or more bits in a byte flip, a non-negligible fraction appear at adjacent bit positions (about 25% for two-bit events in a byte, close to the combinatorial expectation). The paper claims these patterns are common enough, after profiling only about 100 MB of memory, to power two attacks: corrupting the ECDSA nonce so that a two-bit error changes it by ±3·2^i, letting the bounded-distance-decoding-with-predicate lattice method recover the private key from a few hundred signatures; and swapping tokens in the loaded tokenizer dictionary of a GGUF model so that safety-critical words like 'make' become 'lake', silently removing guardrails. The ECDSA result is argued theoretically, with empirical validation left to future work; the tokenizer attack is demonstrated against real tokenizer dictionaries.

Load-bearing premise

The results treat bit positions that appear adjacent in software as physically adjacent memory cells, even though the paper notes that DRAM data swizzling can scramble that mapping; if the correlation is only in the logical layout, the physical explanation and the defense analysis do not follow.

Editorial extensions

If this is right

  • ECDSA deployments that reuse a fixed nonce memory location across handshakes are exposed: with roughly two adjacent nonce bits leaked per signature, the bounded-distance decoding with predicate method recovers 256-bit keys from under 200 signatures.
  • LLM serving stacks that keep tokenizer dictionaries at static loaded addresses inherit a guardrail-bypass path: one or two bit flips can swap a safety-critical prompt word, so system-prompt refusals silently disappear while ordinary behavior is unchanged.
  • Since row-level flips cluster, attackers can profile a DIMM once and concentrate hammering on known weak regions, making multi-bit localized corruption cheaper than random bit-flip attacks.
  • Multi-bit adjacent patterns imply that single-error-correcting ECC, which silently fixes isolated flips, is not a complete defense against TRR-bypassing Rowhammer patterns.
  • Token-swap counting across three tested tokenizers yields tens of thousands of candidate one-flip swaps, so the LLM attack surface is broad even before adjacent flips are considered.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The logical-adjacency caveat cuts both ways: even if data swizzling breaks physical correspondence, the software-visible delta = ±3·2^i pattern is what the ECDSA lattice attack consumes, so the cryptographic exploit would survive a refutation of the physical-clustering story.
  • A direct test of the physical mechanism would be to repeat the profiling on a DIMM whose physical-to-logical bit mapping is known, and check whether logical neighbors are physical neighbors in the flipped pairs.
  • The tokenizer swap attack generalizes beyond safety words: any fixed, addressable table that maps bit patterns to semantic outputs (embedding rows, label maps, configuration files) is a candidate target for the same minimal-flip strategy.
  • Because the paper's ECDSA demonstration is theoretical, the decisive extension is a full fault-injection experiment that drives real OpenSSL nonces to adjacent flips and runs the lattice recovery end to end.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. This paper claims that modern Rowhammer techniques (TRRespass and BlackSmith) generate adjacent bit flips at 'significantly higher frequency than previously documented,' that bit flips within a DRAM row cluster beyond random expectations, and that these phenomena enable two security attacks: ECDSA private key recovery from OpenSSL and LLM guardrail bypass via corruption of tokenizer dictionaries in GGUF model files. The experimental basis is profiling of four DDR4 DIMMs, with byte-level adjacency statistics (Table 1), row-level distance comparisons (Figure 2), and raw adjacent-flip counts (Figure 1). The attack sections are largely theoretical: the ECDSA section reports no end-to-end fault injection, and the LLM section counts potential token swaps and shows an illustrative example. The paper also includes a lattice/HNP appendix reviewing BDD-with-predicate.

Significance. If the central claims were established, the paper would be significant: correlated bit flips could challenge ECC assumptions, enable more efficient ECDSA fault attacks, and extend Rowhammer to LLM safety. The paper deserves credit for a clear experimental setup across multiple DIMMs, a transparent statement of the logical-versus-physical adjacency caveat, and an honest acknowledgment that the ECDSA attack remains theoretical. However, the headline empirical claim is contradicted by the paper's own Table 1, the row-clustering analysis lacks any statistical test, and both attacks are prospective rather than demonstrated. As it stands, the contribution is a set of preliminary observations and attack sketches, not a validated study.

major comments (5)
  1. [Abstract; Section 3 (Fig. 1, Table 1)] The headline claim that adjacent bit flips occur at 'significantly higher frequency than previously documented' is not supported by the paper's own data. Table 1 reports observed adjacency rates of 25.6%, 10.6%, and 8.7% for 2-, 3-, and 4-bit flips within a byte, against theoretical random rates of 25.0%, 10.7%, and 7.1%; these differences are within sampling noise and show that byte-level adjacency follows random placement. Figure 1 reports raw counts (174k single, 3k two-adjacent, 62 three-adjacent, 2 four-adjacent) with no baseline or statistical comparison to any prior work. Without a baseline, significance test, or error bars, the central phenomenon of the paper is unestablished.
  2. [Section 3.1, Figure 2] The row-level clustering claim lacks inferential support. The null hypothesis uses p = n/65536 estimated per row from the observed number of flips n, making the geometric-mean comparison a goodness-of-fit check rather than a test with a stated sampling distribution. Figure 2 has no error bars, confidence intervals, or p-values, and no correction for the many rows examined. The text reports a 'significant' deviation without defining the test; as presented, the figure cannot distinguish clustering from estimation noise or from the effect of restricting analysis to rows with at least one flip.
  3. [Section 3 vs. Sections 2 and 4] The paper conflates logical and physical adjacency in a way that undermines the attack foundations. Section 3 defines adjacent bit flips as consecutive bit positions within the logical address space of a byte and acknowledges that 'logical adjacency may not correspond to physical adjacency in DRAM due to data swizzling,' yet the abstract and Section 2 describe physically neighboring bits and electrical coupling, and Section 4.1's ECDSA arithmetic (Delta = ±3·2^i) and the ECC implications require predictable physical or cell-level adjacency. The paper supplies no evidence that the observed logical adjacency is physical; without that, the physical explanation and the controllability assumptions lose their foundation.
  4. [Section 4.1] The ECDSA key recovery attack is theoretical only. The text admits that 'full empirical validation remains future work,' and no experiment demonstrates a Rowhammer-induced adjacent bit flip in an OpenSSL nonce. The claimed predictable nonce allocation (reuse after the first handshake, concentrations near offset 0xd00) is profiling, not an end-to-end fault injection. Consequently, the abstract's framing that these flips 'could enable ECDSA private key recovery' is at best a plausibility argument based on the Albrecht–Heninger BDD-with-predicate results; it is not a demonstrated attack.
  5. [Section 4.2, Tables 2-3, Figure 4] The LLM tokenizer attack is not empirically demonstrated. Table 2 counts potential token swaps by combining bit-flip offsets from DIMM A3 with offsets in tokenizer dictionary files; no Rowhammer corruption of a running GGUF model is performed, and the illustrative figure showing guardrail bypass uses an uncensored GGUF version, which undercuts the claim of circumventing safety guardrails. The paper also assumes without evidence that bit-flip offsets measured on DIMM A3 occur at the same logical offsets in the model's memory layout. Table 2 also contains an internal inconsistency: the text reports 310k, 78k, and 50k potential swaps for GPT-2, LLaMA, and T5, while the table lists 184k, 50k, and 28k.
minor comments (6)
  1. [Section 2] In the paragraph on modern Rowhammer techniques, 'mechansim' should be 'mechanism'.
  2. [Section 3.1] The sentence 'to simplify the the statistical analysis' contains a duplicated 'the', and the surrounding prose mixes tenses ('we may model ... where we estimate') in a way that should be cleaned up.
  3. [Appendix A, Table 4] The G.SKILL module is described as model F4-3200C16D-16GVKB in the text and as F4-3600C16D-16GVKC in Table 4; these model numbers should be reconciled.
  4. [Section 4.2, Table 2] Beyond the numeric inconsistency noted above, the table caption should state that these are potential swaps computed from combined offsets, not observed corruptions, and Table 3's 'dry' to 'Try' swap changes capitalization in a way that is not discussed.
  5. [Figure 2] The figure would be much more informative if it showed the distribution of the test statistic and error bars rather than a single average point, and if it stated how many rows and how many total flips contributed to each data point.
  6. [References] Reference [16] (DRAMScope) is cited for data swizzling, but no specific result or section is indicated; a page or section pointer would help readers verify the claimed implication.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: the adjacency model and clustering null model are compared to observation rather than fitted, self-citations are not load-bearing, and the ECDSA attack is explicitly theoretical.

full rationale

I walked the claimed derivation chain. (i) The adjacent-bit-flip model in Section 3.2 uses the combinatorial expression P_adj(n,k) = A(n,k)/C(n,k) = (n-k+1)/C(n,k), giving 25.0% for k=2, and compares it against observed percentages (25.6%, 10.6%, 8.7%). No observed adjacency rate is used to fit the model, so this is an independent goodness-of-fit comparison, not a fitted input called a prediction. (ii) The row-level clustering analysis in Section 3.1 estimates p = n/65536 from each row's flip count under a Bernoulli null hypothesis and compares observed mean inter-flip distance to the geometric expectation. This is a standard null-model estimate from the same row, not a clustering parameter tuned to force the observed deviation; the absence of error bars is a statistical-support concern, not circularity. (iii) The ECDSA attack is explicitly presented as theoretical analysis: the paper states 'we acknowledge that full empirical validation remains future work' and relies on the external Albrecht-Heninger bounded-distance-decoding-with-predicate result [17], so no empirical result is being renamed or derived from itself. (iv) The LLM dictionary token-swap attack enumerates candidate swaps by comparing measured bit-flip page offsets with tokenizer dictionary contents; it counts possible swaps rather than fitting a parameter to a predicted outcome. (v) The only self-citations, [11] and [12], appear in the introduction as examples of 'collateral attacks on register values' and are not load-bearing for the paper's central claims. The paper's evidentiary weaknesses (no baseline for Figure 1, Table 1 showing near-chance adjacency rates, and the acknowledged logical-versus-physical adjacency gap in Section 3) are correctness and support issues, not circular reductions. No load-bearing step is equivalent to its own input by construction, so the honest finding is no significant circularity.

Assumptions & free parameters 1 free parameters · 5 assumptions · 0 invented entities

The statistical observations rely on a geometric null model and on treating logical adjacency as physical adjacency. Both attacks further assume that fault offsets measured in free profiling transfer to real victim allocations, namely the nonce in OpenSSL and the tokenizer strings in GGUF. No new physical entities are introduced.

free parameters (1)
  • per-row flip probability p = n/65536 = n/65536 (varies per row)
    Used to define the null hypothesis in Section 3.1; estimated from the same rows that are later judged for clustering, so it is a measured input to the null model rather than a fitted constant of a theory.
assumptions (5)
  • domain assumption Logical bit adjacency is treated as a proxy for physical DRAM cell adjacency, despite data swizzling.
    Invoked in Section 3 for adjacent bit flips and in Section 4.1 for the delta equals plus or minus 3 times 2 to the i patterns; the paper admits logical adjacency may not be physical.
  • domain assumption Bit flips in a row are modeled as independent Bernoulli trials with geometric inter-flip distances under the null.
    Section 3.1 constructs the null as (1-p)^(d-1)p; this ignores the finite row length, sampling without replacement, and boundary effects, and no confidence bands are provided.
  • domain assumption Attacker and victim share the platform, without root or physical access, and the memory uses TRR.
    Threat model in Section 2, standard Rowhammer assumption inherited from prior Rowhammer work.
  • ad hoc to paper The OpenSSL ECDSA nonce is allocated at predictable offsets and can be hit by two adjacent bit flips between computing r and s.
    Section 4.1 profiles nonce offsets across server restarts and targets 0xd00, but no empirical fault injection is shown; the authors state empirical validation is future work.
  • ad hoc to paper Flip offsets observed while fuzzing 100MB of DIMM A3 apply to the memory layout of a running GGUF model's tokenizer dictionary.
    Section 4.2 maps profiling offsets to tokenizer strings and reports potential swaps; no live Rowhammer attack on a running model is performed.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Rubber Mallet: A Study of High Frequency Localized Bit Flips and Their Impact on Security." pith.science (2026). https://pith.science/paper/QHCPPPFG

@misc{pith2026250501518,
  author       = {Pith},
  title        = {Pith review of: Rubber Mallet: A Study of High Frequency Localized Bit Flips and Their Impact on Security},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QHCPPPFG}},
  note         = {Machine review of arXiv:2505.01518}
}
read the original abstract

The increasing density of modern DRAM has heightened its vulnerability to Rowhammer attacks, which induce bit flips by repeatedly accessing specific memory rows. This paper presents an analysis of bit flip patterns generated by advanced Rowhammer techniques that bypass existing hardware defenses. First, we investigate the phenomenon of adjacent bit flips where two or more physically neighboring bits are corrupted simultaneously and demonstrate they occur with significantly higher frequency than previously documented. We also show that if multiple bits flip within a byte, we can probabilistically model the likelihood of flipped bits appearing adjacently. We also demonstrate that bit flips within a row will naturally cluster together likely due to the underlying physics of the attack. We then investigate two fault injection attacks enabled by multiple adjacent or nearby bit flips. First, we show how these correlated flips enable efficient cryptographic signature correction attacks, demonstrating how such flips could enable ECDSA private key recovery from OpenSSL implementations where single-bit approaches would be unfeasible. Second, we introduce a targeted attack against large language models by exploiting Rowhammer-induced corruptions in tokenizer dictionaries of GGUF model files. This attack effectively rewrites safety instructions in system prompts by swapping safety-critical tokens with benign alternatives, circumventing model guardrails while maintaining normal functionality in other contexts. Our experimental results across multiple DRAM configurations reveal that current memory protection schemes are inadequate against these sophisticated attack vectors, which can achieve their objectives with precise, minimal modifications rather than random corruption.

Figures

Figures reproduced from arXiv: 2505.01518 by the authors.

Figure 1
Figure 1. Absolute number of adjacent bit flips seen after pro [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Rowhammer experiment using TRRespass [1] show￾ing a deviation from the expected random distribution of bit flips across a page be random. We chose to analyze the data at the byte level (at least 1 flip occurred within a byte) for two reasons; to simplify the the statistical analysis and computer hardware is architec￾turally designed around bytes. We devised a statistical model for the null hypothesis as: the distrib… view at source ↗
Figure 3
Figure 3. A single bit flip in an ASCII-encoded character can [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

20 extracted references · 16 canonical work pages

  1. [1]

    TRRespass: Exploiting the many sides of target row refresh,

    P. Frigo, E. Vannacc, H. Hassan, V. Van Der Veen, O. Mutlu, C. Giuffrida, H. Bos, and K. Razavi, “TRRespass: Exploiting the many sides of target row refresh, ” in2020 IEEE Symposium on Security and Privacy (SP). IEEE, 2020, pp. 747–762

    work page 2020

  2. [2]

    Blacksmith: Scalable rowhammering in the frequency domain,

    P. Jattke, V. van der Veen, P. Frigo, S. Gunter, and K. Razavi, “Blacksmith: Scalable rowhammering in the frequency domain, ” in2022 IEEE Symposium on Security and Privacy (SP), vol. 1, 2022

    work page 2022

  3. [3]

    Flipping bits in memory without accessing them: An experimental study of dram disturbance errors,

    Y. Kim, R. Daly, J. Kim, C. Fallin, J. H. Lee, D. Lee, C. Wilkerson, K. Lai, and O. Mutlu, “Flipping bits in memory without accessing them: An experimental study of dram disturbance errors, ”ACM SIGARCH Computer Architecture News, vol. 42, no. 3, pp. 361–372, 2014

    work page 2014

  4. [4]

    Exploiting the dram rowhammer bug to gain kernel privileges,

    M. Seaborn and T. Dullien, “Exploiting the dram rowhammer bug to gain kernel privileges, ”Black Hat, vol. 15, p. 71, 2015

    work page 2015

  5. [5]

    Rowhammer. js: A remote software-induced fault attack in javascript,

    D. Gruss, C. Maurice, and S. Mangard, “Rowhammer. js: A remote software-induced fault attack in javascript, ” inInternational conference on detection of intrusions and malware, and vulnerability assessment. Springer, 2016, pp. 300–321

    work page 2016

  6. [6]

    SMASH: Synchronized many-sided rowhammer attacks from JavaScript,

    F. de Ridder, P. Frigo, E. Vannacci, H. Bos, C. Giuffrida, and K. Razavi, “SMASH: Synchronized many-sided rowhammer attacks from JavaScript, ” in30th USENIX Security Symposium (USENIX Security 21). USENIX Association, Aug. 2021, pp. 1001–1018

    work page 2021

  7. [7]

    Throwhammer: Rowhammer attacks over the network and defenses,

    A. Tatar, R. K. Konoth, E. Athanasopoulos, C. Giuffrida, H. Bos, and K. Razavi, “Throwhammer: Rowhammer attacks over the network and defenses, ” in2018 USENIX Annual Technical Conference (USENIX ATC 18). Boston, MA: USENIX Association, Jul. 2018, pp. 213–226

    work page 2018

  8. [8]

    Nethammer: Inducing rowhammer faults through network requests,

    M. Lipp, M. Schwarz, L. Raab, L. Lamster, M. T. Aga, C. Maurice, and D. Gruss, “Nethammer: Inducing rowhammer faults through network requests, ” in2020 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW). IEEE, 2020, pp. 710–719

    work page 2020

Show all 20 references
  1. [9]

    One bit flips, one cloud flops: Cross-VM row hammer attacks and privilege escalation,

    Y. Xiao, X. Zhang, Y. Zhang, and R. Teodorescu, “One bit flips, one cloud flops: Cross-VM row hammer attacks and privilege escalation, ” in25th USENIX Security Symposium (USENIX Security 16). Austin, TX: USENIX Association, Aug. 2016, pp. 19–35

    2016

  2. [10]

    Are we susceptible to rowhammer? an end-to-end methodology for cloud providers,

    L. Cojocar, J. Kim, M. Patel, L. Tsai, S. Saroiu, A. Wolman, and O. Mutlu, “Are we susceptible to rowhammer? an end-to-end methodology for cloud providers, ” in 2020 IEEE Symposium on Security and Privacy (SP). IEEE, 2020, pp. 712–728

    2020

  3. [11]

    Mayhem: Targeted corruption of register and stack variables,

    A. J. Adiletta, M. C. Tol, Y. Doröz, and B. Sunar, “Mayhem: Targeted corruption of register and stack variables, ” inProceedings of the 2024 ACM Asia Conference on Computer and Communications Security, 2024

    2024

  4. [12]

    Leapfrog: The rowhammer instruction skip attack,

    A. Adiletta, M. C. Tol, K. Derya, B. Sunar, and S. Islam, “Leapfrog: The rowhammer instruction skip attack, ”arXiv preprint arXiv:2404.07878, 2024

    2024 arXiv

  5. [13]

    Half-double: Hammering from the next row over,

    A. Kogler, J. Juffinger, S. Qazi, Y. Kim, M. Lipp, N. Boichat, E. Shiu, M. Nissler, and D. Gruss, “Half-double: Hammering from the next row over, ” in31st USENIX Security Symposium: USENIX Security’22, 2022

    2022

  6. [14]

    Pris- onbreak: Jailbreaking large language models with fewer than twenty-five targeted bit-flips,

    Z. Coalson, J. Woo, S. Chen, Y. Sun, L. Yang, P. Nair, B. Fang, and S. Hong, “Pris- onbreak: Jailbreaking large language models with fewer than twenty-five targeted bit-flips, ”arXiv preprint arXiv:2412.07192, 2024

    2024

  7. [15]

    Attentionbreaker: Adaptive evolutionary optimization for unmasking vulnerabilities in llms through bit-flip attacks,

    S. Das, S. Bhattacharya, S. Kundu, S. Kundu, A. Menon, A. Raha, and K. Basu, “Attentionbreaker: Adaptive evolutionary optimization for unmasking vulnerabilities in llms through bit-flip attacks, ”arXiv preprint arXiv:2411.13757, 2024

    2024 arXiv

  8. [16]

    Dramscope: Uncovering dram microarchitecture and characteristics by issuing memory commands,

    H. Nam, S. Baek, M. Wi, M. J. Kim, J. Park, C. Song, N. S. Kim, and J. H. Ahn, “Dramscope: Uncovering dram microarchitecture and characteristics by issuing memory commands, ” in2024 ACM/IEEE 51st Annual International Symposium on Computer Architecture (ISCA). IEEE, 2024, pp. 1097–1111

    2024

  9. [17]

    On bounded distance decoding with predicate: Breaking the “lattice barrier

    M. R. Albrecht and N. Heninger, “On bounded distance decoding with predicate: Breaking the “lattice barrier” for the hidden number problem, ” inAdvances in Cryp- tology – EUROCRYPT 2021, A. Canteaut and F.-X. Standaert, Eds. Cham: Springer International Publishing, 2021, pp. 528–558

    2021

  10. [18]

    Hardness of computing the most significant bits of secret keys in diffie-hellman and related schemes,

    D. Boneh and R. Venkatesan, “Hardness of computing the most significant bits of secret keys in diffie-hellman and related schemes, ” inAdvances in Cryptol- ogy—CRYPTO’96: 16th Annual International Cryptology Conference Santa Barbara, California, USA August 18–22, 1996 Proceedi...

    1996

  11. [19]

    Ladderleak: Breaking ecdsa with less than one bit of nonce leakage,

    D. F. Aranha, F. R. Novaes, A. Takahashi, M. Tibouchi, and Y. Yarom, “Ladderleak: Breaking ecdsa with less than one bit of nonce leakage, ” inProceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security. New York, NY, USA: Association for Computing Mac...

    2020

  12. [20]

    GLV/GLS decomposition, power analysis, and attacks on ECDSA signatures with single-bit nonce bias,

    D. F. Aranha, P. Fouque, B. Gérard, J. Kammerer, M. Tibouchi, and J. Zapalowicz, “GLV/GLS decomposition, power analysis, and attacks on ECDSA signatures with single-bit nonce bias, ” inAdvances in Cryptology - ASIACRYPT 2014 - 20th International Conference on the Theory and Ap...

    2014

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.