Secret Key Recovery of NIST P-521 Private Keys through biased ECDSA nonces in PuTTY client
The PuTTY client and all related components generate heavily biased ECDSA nonces in the case of NIST P-521. This allows for full secret key recovery in roughly 60 signatures by using state-of-the-art techniques. These signatures can either be harvested by a malicious server (machine-in-the-middle attacks are not possible given that clients do not transmit their signature in the clear) or from any other source, e.g. signed git commits through forwarded agents.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-31497US | medium5.9 | Exploit | ||
In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521 secret key via a quick attack in approximately 60 signatures… | ||||
references
External citations — patches, advisories, analysis.
remediations (5)
- FixedFileZilla Client
Update to the latest version of the product. At least version 3.67.0.
https://filezilla-project.org/download.php?type=client - FixedPuTTY
Update to the latest version of the product. At least version 0.61. Additionally, any key material using NIST P-521 must be revoke/discard and new keys have to be generated.
https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html - FixedTortoiseGit
Update to the latest version of the product. At least version 2.15.0.1.
https://tortoisegit.org/download/ - FixedWinSCP
Update to the latest version of the product. At least version 6.3.3.
https://winscp.net/eng/download.php - WorkaroundTortoiseSVN
As long as there is no official patch available: Configure TortoiseSVN to use PuTTY's latest plink.exe instead of the included exe.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan