NSA's Backdoor Key from Lotus Notes (2002)
Was it systematically leaking the same 24 bits (encrypted to the NSA public key), or a random contiguous selection of 24 bits?<p>in the second case having just a few documents would result in only the NSA being able to decrypt without even brute forcing...