Reflected public keys: recovering the six digits of Bluetooth Passkey Entry
Bluetooth Passkey Entry spends a bit of the passkey per round so it can never be brute-forced offline. Reflect the initiator's public key back at it and it hands over one bit per round instead.
found by Tristan Claverie and José Lopes Esteves, ANSSI