[throwawaymath]

In particular, see also this 2005 paper by Thomas Pornin: http://www.bolet.org/~pornin/2005-acns-pornin+stern.pdf

EDIT: Looks like this paper is also already included in the list of citations for the 2019 paper :)

[tptacek]

This is also a Cryptopals exercise in Set 8:

https://toadstyle.org/cryptopals/61.txt

[baby]

The first time I heard of this bug was through the Another Look series where it was called DSKS.