Lattice attacks: recovering keys from biased nonces
Nonce reuse is the obvious failure. The subtle one: nonces that are merely biased — a few predictable bits — still leak the key, via lattice reduction.
The Hidden Number Problem
Suppose an implementation's nonces are not repeated, but are slightly predictable — say the top few bits are always zero because of a weak RNG, a timing side channel, or a buggy hardware wallet. Each signature then gives a noisy linear equation about the private key. Collect a handful of them and you have an instance of the Hidden Number Problem, which can be solved with LLL lattice basis reduction.
With a 128-bit bias, two signatures can be enough; with a smaller ~64-bit bias, around four. That is a remarkably low bar — an attacker who can collect a few signatures from a leaky device can walk away with the key.
Real-world examples
Lattice attacks are the engine behind several disclosed bugs, including Minerva and TPM-Fail (timing side channels that leaked nonce bits from smartcards and TPMs) and various hardware-wallet nonce-generation flaws. They are a standard tool in cryptographic auditing.
The defense
Generate nonces with a secure, constant-time process — again, RFC 6979 deterministic nonces plus side-channel-resistant implementations. This mode runs LLL reduction over a set of signatures you provide and, if the nonces were biased, recovers and verifies the key.