PuTTY vulnerability vuln-p521-bias (chiark.greenend.org.uk)

Article summary

A critical vulnerability has been discovered in the PuTTY tools, affecting versions 0.68 to 0.80, which can compromise private keys using the NIST P521 curve. The vulnerability allows an attacker to recover the private key and forge signatures, but only affects keys used with PuTTY or Pageant. The issue is due to a biased nonce generation method, which has been fixed by switching to the RFC 6979 technique. Users with affected keys are advised to revoke and replace them.

Main themes

• PuTTY vulnerability
• ECDSA key compromise
• Nonce generation
• Cryptographic security
• Key management

What commenters say

• The vulnerability only affects client keys used with PuTTY, and server host keys are not at risk.
• Deterministic nonce generation, although intended to be secure, can sometimes lead to vulnerabilities like this one.
• Using a hardware key with touch-to-sign functionality can provide an additional layer of security for SSH authentication.
• The discovery of this vulnerability highlights the importance of regular security reviews and audits of widely-used open-source codebases like PuTTY.
• Some commenters argue that Schnorr signatures would not have prevented this specific vulnerability, while others believe that they would have been a better choice than ECDSA.
• The use of P-521 curve is not the primary cause of the vulnerability, but rather the interaction between SHA512 and P-521.
• Regular users may not need to worry about this vulnerability if they only connect to trusted hosts and use secure key management practices.
• The Windows built-in SSH agent can be used instead of Pageant, and it provides a more integrated and secure solution for managing SSH keys.