Carry propagation bugs are more or less self-explanatory: the implementer failed to add every possible carry bit during a large integer addition or multiplication, and this turns into an incorrect result. This may only happen in rare edge cases, and therefore remain unnoticed for a long, long time. The sibling comment explains this better than I could.<p>A carry propagation bug is a special case of a <i>fault attack</i>. Fault attacks, in their most general form, are attacks where an adversary tries to induce an error during a cryptographic computation. The consequences of a fault during a computation are algorithm-specific; here are some examples:<p>- In RSA, a fault during a <i>decryption</i> or <i>signature</i> operation using a particular (CRT) implementation approach lets the attacker recover the private key [1]. You do this by obtaining an incorrect signature S for some message M you know about, and then recover one of the prime factors of the modulus with the easy computation gcd(S - M^e, N). This is often called the Bellcore attack.<p>- With elliptic curves, if you can convince a scalar multiplication to work on an incorrect point on the curve (either because the implementation doesn&#x27;t check the point is valid, or via a hardware fault), you can likewise recover the secret key [2]. The process here is a little more complicated, but no less efficient.<p>- With AES, if you can trigger a fault in a state byte right before the eighth round, you can recover the full key very easily having both the valid ciphertext and the erroneous one [3]. This attack only makes sense for hardware implementations, since software implementations of symmetric ciphers do not generally leave much space for errors to occur.<p>In the Golang case, the carry bit failure leads to the Bellcore attack. All you have to do, in principle, is to harvest around 2^25 RSA signatures (and respctive messages) from a buggy target, compute a GCD, and you&#x27;re done.<p>[1] <a href="https:&#x2F;&#x2F;doi.org&#x2F;10.1007&#x2F;3-540-69053-0_4" rel="nofollow">https:&#x2F;&#x2F;doi.org&#x2F;10.1007&#x2F;3-540-69053-0_4</a><p>[2] <a href="https:&#x2F;&#x2F;doi.org&#x2F;10.1007&#x2F;3-540-44598-6_8" rel="nofollow">https:&#x2F;&#x2F;doi.org&#x2F;10.1007&#x2F;3-540-44598-6_8</a><p>[3] <a href="https:&#x2F;&#x2F;eprint.iacr.org&#x2F;2009&#x2F;575" rel="nofollow">https:&#x2F;&#x2F;eprint.iacr.org&#x2F;2009&#x2F;575</a>