This blog post explains it a bit:

https://blog.cryptographyengineering.com/2017/10/16/falling-...