A One-Time Single-bit Fault Leaks All Previous NTRU-HRSS Session Keys to a Chosen-Ciphertext Attack.

Daniel J. Bernstein

Browse the full INDOCRYPT paper archive.