When attack.recover() returns None, the CLI always reports the reason as "all pairs have s1 == s2" — regardless of which attack type is running.
// main.rs:224-228
} else {
(
"unrecoverable".to_string(),
Some("all pairs have s1 == s2".to_string()), // always this
None,
)
};This is only accurate for nonce-reuse. For the other attacks, recovery fails for completely different reasons:
- polynonce: elimination polynomial roots didn't verify as valid keys via
k*G check
- biased-nonce: lattice reduction didn't produce a short enough vector containing the private key
The current message is actively misleading — a user running --attack=polynonce who sees "all pairs have s1 == s2" has no useful information about what went wrong.
Fix: Either make Attack::recover() return a Result<RecoveredKey, RecoveryError> with typed failure reasons, or at minimum make the fallback message generic (e.g. "recovery did not produce a valid key") rather than attack-specific.
When
attack.recover()returnsNone, the CLI always reports the reason as"all pairs have s1 == s2"— regardless of which attack type is running.This is only accurate for nonce-reuse. For the other attacks, recovery fails for completely different reasons:
k*GcheckThe current message is actively misleading — a user running
--attack=polynoncewho sees "all pairs have s1 == s2" has no useful information about what went wrong.Fix: Either make
Attack::recover()return aResult<RecoveredKey, RecoveryError>with typed failure reasons, or at minimum make the fallback message generic (e.g. "recovery did not produce a valid key") rather than attack-specific.