In the Hidden Number Problem (HNP), the goal is to find a hidden number s, when given p, g and access to an oracle that on query a returns the k most significant bits of s · ga ...
We present a polynomial-time algorithm that provably recovers the signer's secret DSA key when a few bits of the random nonces k (used at each signature generation) are known ...