https://blog.cryptographyengineering.com/2017/02/28/the-futu... there's also this post by Matthew Green (which has been submitted before to HN but hasn't gotten comments)