The bet that early lattice signatures didn't give away the secret key. Each signature leaked a little, and a few hundred revealed it all.
The idea: To sign, the signer uses the good basis to round the message's hash to a nearby lattice point. The rounding error always falls inside one fixed box-shaped region whose shape is the secret basis. Each signature is a random dot inside that box. Plot enough dots and the box's edges, and so the key, show up. Modern schemes randomize the rounding so the dots form a round cloud that hides the basis.
Why it matters: It's why modern lattice signatures like Falcon and ML-DSA are built so that signatures reveal nothing.
On the map: ✗ broken 2006 (Nguyen-Regev): 400 signatures revealed an NTRUSign-251 key
GGH-style signatures use a lattice trapdoor: the signer uses a good, secret basis to find a lattice point close to the message's hash. But the difference between hash and signature always lands inside a shape fixed by the secret basis (a parallelepiped). Each signature is a random point in that shape. Collect enough of them and the shape, and with it the key, appears.
Nguyen and Regev (Eurocrypt 2006)[1, 2] turned this into an attack: 400 signatures recovered an NTRUSign-251 key. The "perturbation" countermeasure later added to NTRUSign fell in 2012 (Ducas and Nguyen)[3]. The lattice problems themselves were never solved. The signatures leaked. Modern lattice signatures avoid this by design: Falcon samples from a carefully shaped Gaussian distribution[4] that reveals nothing about the basis, and ML-DSA uses rejection sampling[5].
If any of these breaks, this breaks too.
If this breaks, these break with it.