the sampler that passed every test and was still wrong

A masking value is what hides the secret in a challenge-response exchange; if the mask is wrong in any way, the secret leaks through the mask. Ours was generated with a familiar recipe: draw from a continuous distribution in double precision, scale, round. It passed every functional test we had, and it was broken in three independent ways.

First, precision. At the width we needed, the exponent consumed almost the whole mantissa and left only a handful of fractional bits. The output was not a continuous distribution sampled coarsely; it had structural gaps, and the gaps were a function of the mask's own magnitude, which is not something an attacker is supposed to learn. Second, timing: the library functions used to evaluate the distribution take data-dependent time, and a mask that leaks through timing is worse than one that leaks in the clear, because the leak never appears in the transcript. Third, the polynomial approximations behind those functions were biased, and a biased mask is a distinguishable mask.

The replacement samples in integers, uses floating point only where an exponent is scaled so its error cannot reach the result, and bounds resampling to a fixed number of iterations so the cost does not depend on the value. The cost was a rewrite of the generator and its tests.

The lesson is not that the recipe was bad. It is that a sampler can be validated for the wrong property. Distributional tests see shape, not machine behaviour, and neither sees the leak. What it proves is that the team can find a defect no functional test was ever going to report, in a component already declared finished.