13 ms·
PuTTY vulnerability vuln-p521-bias
- chasil 3y agoI use P521 for all my server host keys. Do these need to be rotated after my users upgrade their PuTTY clients?
- strbean 3y ago> (The problem is not with how the key was originally generated; it doesn't matter whether it came from PuTTYgen or somewhere else. What matters is whether it was ever used with PuTTY or Pageant.) Sounds like your server keys are safe.
- cchance 3y agoI mean it also sounds like you'd need to be using a exploited server, or give the hacker access to your pageant...
- germinator 3y agoThis exposed client keys, not server keys. The client keys are at risk only in a handful of specific scenarios - e.g., if used to connect to rogue or compromised servers, or used for signing outside SSH. This is not exploitable by simply passively watching traffic, so even for client keys, if you're certain that they were used in a constrained way, you should be fine. The difficulty is knowing that for sure, so it's still prudent to rotate.
- Skrillor 3y agoNo, only NIST P-521 client keys used with PuTTY are affected. The server host key signature is computed by the server (most likely OpenSSH) which is unaffected.
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- axus 3y agoGood thing everyone uses the defaults and never picks that type of key!
- formerly_proven 3y agoECDSA strikes again. Bad nonce generation (here: generating a 521 bit nonce by calculating a 512 bit number and then taking that modulo 2^521, which means the top bits of the nonce are always zero) leading to private key compromise. Classic.
- JamesCoyne 3y agoDetails in the excellent commit message https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=c193fe9848f50a88a4089aac647fecc31ae96d27 https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=c...
- rainsford 3y agoYes, although this is the rare ECDSA private key recovery issue where deterministic nonce generation was the cause of rather than the solution to the problem.
- metadat 3y agoI wish this announcement included the backstory of how someone discovered this vulnerability. Public keys are enough of a pain in the ass with PuTTY / KiTTY that I stick with password auth for my windows SSH'ing needs. KiTTY even let's you save the passwords so you don't have to type it in, a horrible security practice no doubt, but so convenient... Perhaps more secure than the putty-gen'd ECDSA P521 keys? A tad bit ironic.
- chasil 3y agoIronically, DJB considers the 521 curve to be the only NIST standard that uses reasonable primes. "To be fair I should mention that there's one standard NIST curve using a nice prime, namely 2^521 - 1; but the sheer size of this prime makes it much slower than NIST P-256." http://blog.cr.yp.to/20140323-ecdsa.html http://blog.cr.yp.to/20140323-ecdsa.html http://safecurves.cr.yp.to/rigid.html http://safecurves.cr.yp.to/rigid.html
- pclmulqdq 3y agoThe 521 curve is the only one using a Mersenne prime, which has significant advantages when you do calculations, but also feels less arbitrary.
- kwantam 3y agoThis vulnerability has very little to do with P-521 per se. The issue is with ECDSA: any use of ECDSA with biased nonce generation, regardless of the elliptic curve it's implemented over, immediately causes secret key leakage. (Rant: All these years later, we're all still doing penance for the fact that Schnorr signatures were patented and so everyone used ECDSA instead. It's an absolute garbage fire of a signature scheme and should be abandoned yesterday for many reasons, e.g., no real proof of security, terrible footguns like this.)
- djao 3y agoSchnorr wouldn't have helped in this specific case, since Schnorr is equally vulnerable to biased nonces (https://ecc2017.cs.ru.nl/slides/ecc2017-tibouchi.pdf https://ecc2017.cs.ru.nl/slides/ecc2017-tibouchi.pdf). EdDSA, which is essentially deterministic Schnorr, does solve the problem. Also, the use of P-521 didn't specifically cause the vulnerability, but the bad interaction between SHA512 and P-521 did play a role. It is unfortunate that nature conspired against us to make 2^511 - 1 a composite number. The fact that you have to go up to 521 bits to get a Mersenne prime whereas the natural target length for a hash output is 512 bits is the fatal interaction here.
- deleted 3y ago[deleted]
- WorldMaker 3y agoSometimes useful reminder: you may not need PuTTY today. On the one side Windows Terminal does a lot of the classic VT* terminal emulation that old ConHost did not. On the other side Windows ships "real" OpenSSH now as a feature that turns on automatically with Windows "Dev Mode". No built in GUI for the SSH agent, but at this point if you are familiar with SSH then using a CLI SSH agent shouldn't be scary. If you are "upgrading" from PuTTY you just need to export your keys to a different format, but that's about the only big change. PuTTY was a great tool for many years and a lot of people have good reasons to not want to let it go. As with most software it accretes habits and processes built on top of it that are hard to leave. But also useful to sometimes remind about the new options because you never know who wants to be in the Lucky 10K to learn that Windows Terminal now has deeper, "true" terminal emulation or that Windows has ssh "built-in".
- chasil 3y agoI am on a corporate desktop, so I cannot use the Microsoft variant of the ssh-agent: C:\Users\luser>ssh-agent unable to start ssh-agent service, error :1058 Obviously, getting that changed globally (or even for myself) is impossible. PuTTY has a workaround, allowing PAGENT.EXE to be used in place of the forbidden/inaccessible Microsoft agent: https://tartarus.org/~simon/putty-snapshots/htmldoc/Chapter9.html#pageant-cmdline-openssh https://tartarus.org/~simon/putty-snapshots/htmldoc/Chapter9... So PuTTY remains quite relevant because of the mechanisms that Microsoft has chosen.
- WorldMaker 3y agoI'm sorry that you need to work around the inability to run a simple Windows service because of some mistakenly bad corporate policy trying to micro-manage which Windows services are allowed to run. I don't think the long term solution should be "shadow IT install an older app just because it pretends to be a GUI rather than a Windows service", but I'm glad it is working for you in the short term. If you need ammunition to encourage your corporate IT to allow you to run the proper ssh-agent service to do your job instead of increasing your attack surface by installing PuTTY/Pageant, you could collect a list of vulnerabilities such as the one posted here (look at the huge count of affected versions on just this one!). There should be plenty of vulnerability maintenance evidence on the Microsoft-shipped version of an open source tool with a lot of eyeballs because it is "the standard" for almost all platforms over the "single developer" tool that took at least a decade off from active development (and it shows).
- indigodaddy 3y ago[flagged]
- kelsey98765431 3y agoFriendly reminder you can entirely disable elliptic curve algorithms in your sshd_config and generate rsa keys larger than 4096 bits, 8192 or however large you like work just fine. I have never trusted EC crypto because of all the magic involved with it, a sufficient reason to move from RSA has never been presented with compelling evidence as far as I am concerned. I do not care that it is faster, i prefer slow and secure to fast and complicated. It's a lot easier to explain RSA and why it's secure than the mile long justifications on curve crypto. The issue doesn't need to be in the algorithm, if the implementation is sufficiently difficult that works just as well as an intentionally misdesigned algorithm.
- wkat4242 3y agoYeah I never bought into the EC thing much either. It's supposed to be safer against quantum but it's also a lot less proven.
- lambdafu 3y agoActually, with currently common key sizes, ECC up to 384 bits will fall to QC before RSA with 1024 bits, because fewer bits means fewer qubits needed. The main disadvantage of RSA is the structure of finite fields, which allows specialized solutions to factoring (number field sieve). We do not know similar structures for elliptic curves, so for those we only have general attacks, thus allowing shorter key lengths.
- kbolino 3y agoThe benefit of EC is not speed, it is much smaller key sizes. Roughly speaking, an RSA key has to be 8 times as large as an EC key for the same security level.
- gruez 3y agoedit: ignore below, I misinterpreted what q meant in this context and thought it was the private key. >The clever trick is to compute a secure hash whose input includes the message to be signed and also the private key [...] > PuTTY's technique worked by making a SHA-512 hash, and then reducing it mod q, where q is the order of the group used in the DSA system. For integer DSA (for which PuTTY's technique was originally developed), q is about 160 bits; for elliptic-curve DSA (which came later) it has about the same number of bits as the curve modulus, so 256 or 384 or 521 bits for the NIST curves. I know hindsight is 20/20, but why did PuTTY implement it this way to begin with? Given the description in the first paragraph, I'd naively implemented it as SHA-512(message || private_key)[:number_of_bits_required] or if I was being paranoid I would have done SHA-512(SHA-512(message) || SHA-512(private_key))[:number_of_bits_required] Moduloing it by q makes no sense unless you're trying to save a few cycles.
- chasil 3y agoIt appears that some of this was designed in the late 90s/early aughts, when Windows didn't have a cryptographically-secure random number generator. PuTTY carries its own formats from this time.
- gruez 3y agoYou don't need a CSPRNG to do SHA512, which their solution already incorporates.
- chasil 3y agoThis is the text from the original article. "For this reason, since PuTTY was developed on Windows before it had any cryptographic random number generator at all, PuTTY has always generated its k using a deterministic method, avoiding the need for random numbers at all."
- gruez 3y agoBoth my proposed naive method and the PuTTY implementation are deterministic. The only difference is how the primitives (eg. SHA-512) are combined.
- AtNightWeCode 3y agoWe recommend against ECDSA for internal accounts. I know several of our partners use it though. Hard to not be cynical about this even though this issue seems mostly harmless.
- AtNightWeCode 3y agoNSA disagrees...
- tptacek 3y agoThis is one of the all-time cryptography footguns, an absolutely perfect example of how systems development intuition fails in cryptography engineering. The problem here is the distinction between an n-bit random number and n-bit modulus. In DSA, if you're working with a 521-bit modulus, and you need a random k value for it, k needs to be random across all 521-bits. Systems programming intuition tells you that a 512-bit random number is, to within mind-boggling tolerances, as unguessable as a 521-bit random number. But that's not the point. A 512 bit modulus leaves 9 zero bits, which are legible to cryptanalysis as bias. In the DSA/ECDSA equation, this reduces through linear algebra to the Hidden Number Problem, solvable over some number of sample signatures for the private key using CVP. Later Here you go, from Sean Devlin's Cryptopals Set 8: https://cryptopals.com/sets/8/challenges/62.txt https://cryptopals.com/sets/8/challenges/62.txt
- rainsford 3y agoWhat's really interesting to me is that there was a known solution to the DSA/ECDSA nonce generation problem, RFC 6979, which was published 4 years before the vulnerability was introduced into PuTTY. And it sounds like the developer knew about this RFC at the time but didn't implement it because the much earlier version of deterministic nonce generation that PuTTY already had seemed similar enough and the differences were assessed to not be security critical. So I think the other lesson here is that deviating from a cryptographic right answer is a major footgun unless you understand exactly why the recommendation works the way it does and exactly what the implications are of you doing it differently.
- tptacek 3y agoI think 6979 is a bit of a red herring here. 6979 is about deterministic nonce generation, which is what you do to dodge the problem of having an insecure RNG. But the problem here isn't that the RNG is secure; it's more fundamentally a problem of not understanding what the rules of the nonce are. But I may be hair-splitting. Like, yeah, they freelanced their own deterministic nonce generation. Either way, I think this code long predates 6979.
- 3y ago
- londons_explore 3y agoSo this signing method requires a 521 bit random number, and this flaw caused the top 9 bits of that number to be zero instead, and somehow after 60 signatures this leaks the private key? Anyone care to explain how exactly? How it it any different to the top 9 bits being zero by chance (which happens in 1 out of ~500 attempts anyway)
- lambdafu 3y agoFor the attack all 60 signatures need a nonce that is special in this way. If for example only one out of the 60 is short, the attack fails in the lattice reduction step. The reason is that in the attack, all 60 short nonces "collude" to make up a very special short vector in the lattice, which is much shorter than usual because it is short in all 60 dimensions, not just one out of 500 dimensions. The approximate shortest vector is then obtainable in polynomial time, and this happens to contain the secret key by construction. As an analogy: Imagine you had a treasure map with 60 steps "go left, go right, go up, go down, go down again" etc. If only one out of 60 instructions where correct, you wouldn't know where the treasure is. All of the instructions need to be correct to get there.
- jwilk 3y agoSure, it happens by chance, but the attacker doesn't know when it happens.
- janmo 3y agoDoesn't make sense to me as well, even when fully random after 30,000 signatures you would get around 60 signatures where the nonce starts with nine zero bits. I suspect there must be something else at play here. EDIT: the nonce is PRIVATE, so the scenario I described would not work because we wouldn't know for which of the 30k signatures the nonce starts with 9 zero bits. Makes sense now.
- gs17 3y agoIf I'm understanding correctly, the difference is between knowing you have 60 and having to try (30000!/(60! * (30000 - 60)!) combinations and seeing if they worked, which is quite a few.
- wkat4242 3y agoCool, I never use keys generated by putty, so I'm good. I only use keys generated by and stored on hardware tokens like yubikeys and openpgp smartcards. Edit: To clarify further, the key in that case is not even handled by putty. All crypto ops are done on the token and the private key never leaves it. It can't be exported even because that defeats the purpose of using a hardware token. So putty will just tell the token or smartcard what to sign and the token returns the output. That's why it's safe against this attack. Putty never handles the private key material in this scenario. So I never imported the private key in putty or pageant and I couldn't even if I wanted to. The agent just declares the public keys on the token. I see all the downvotes but I didn't explain it properly. I've been using smart cards so long that these things are kinda a given for me. I can really recommend doing it this way or doing the more modern fido2 auth. Hardware authentication is amazing and it even works on Android over nfc these days. The biggest vulnerability I see is the issue of malware connecting to the unlocked token via the SSH agent, but I'm only using tokens that have touch to sign for this reason. They require a touch on the token for every operation.
- Bootvis 3y agoFrom the article: > (The problem is not with how the key was originally generated; it doesn't matter whether it came from PuTTYgen or somewhere else. What matters is whether it was ever used with PuTTY or Pageant.)
- garaetjjte 3y agoSmartcards do signing operations on the card itself, so it doesn't apply in this case.
- wkat4242 3y agoThanks for pointing this out. I know this but I didn't clarify it in my post.
- ZekeSulastin 3y agoEdit: beat to it, whoops! Never underestimate the Internet’s drive to post easy corrections >.> —— Unfortunately, about that: “(The problem is not with how the key was originally generated; it doesn't matter whether it came from PuTTYgen or somewhere else. What matters is whether it was ever used with PuTTY or Pageant.)”
- gorgoiler 3y agoA complete aside, but I just realised that putty is named after the old fashioned adhesive clay used to cement window panes into the frames of windows. PuTTY… Windows… gosh I feel dumb. I’ve used putty for almost 25 years but didn’t put two and two together until I just remembered how the pheasants in my garden would peck out the window putty to get at the ladybirds hibernating underneath.
- jwilk 3y agohttps://www.chiark.greenend.org.uk/~sgtatham/putty/faq.html#faq-meaning https://www.chiark.greenend.org.uk/~sgtatham/putty/faq.html#... > What does ‘PuTTY’ mean? > It's the name of a popular SSH and Telnet client. Any other meaning is in the eye of the beholder. It's been rumoured that ‘PuTTY’ is the antonym of ‘getty’, or that it's the stuff that makes your Windows useful, or that it's a kind of plutonium Teletype. We couldn't possibly comment on such allegations.
- blueflow 3y agoThis is a human bias to assume that there must be some deeper meaning behind things.
- MaxBarraclough 3y agoI don't have a substantive comment to offer, but good on Simon Tatham for the clear and forthcoming write-up. No damage-control lawyerly BS, no 'ego', just the facts about the issue. It's reassuring to see a solid disclosure after a security issue, and we too often see half-truths and deceptive downplaying, e.g. LastPass.
- loop22 3y ago> No damage-control lawyerly BS, no 'ego' And no cutesy name for the vulnerability
- xwolfi 3y agoThe "Dragon Eater Vulnerability", that all managers will agitate about mitigating for the next 4 weeks...
- d-z-m 3y agoSillyPutty
- SV_BubbleTime 3y agoCanon now.
- rustcleaner 3y agoSeconded.
- Sohcahtoa82 3y agoI think named vulnerabilities are useful when it's a "STOP THE WORLD" kind of vulnerability like Heartbleed and Shellshock. It's much easier to talk about Heartbleed than "CVE-2014-0160". The problem, IMO, is when medium-severity vulnerabilities are given names, like Terrapin. I think it makes people think a vulnerability is much worse than it really is.
- Kikawala 3y agoIf you haven't already, this is probably a good time to switch to EdDSA keys. EdDSA signatures don't require RNG nor modular math unlike ECSDA signatures.
- eyegor 3y agoDespite being fairly old, many systems still don't support eddsa. As an example, the reference browser/ca spec doesn't allow it: https://cabforum.org/working-groups/server/baseline-requirements/documents/ https://cabforum.org/working-groups/server/baseline-requirem.... Last I tried, even let's encrypt won't grant an ed25519 cert despite it being in tls 1.3 (2018?).
- throw0101c 3y ago> Last I tried, even let's encrypt won't grant an ed25519 cert despite it being in tls 1.3 (2018?). Talk to the CA/Browser Forum. §6.1.5 Keys Sizes: > For RSA key pairs the CA SHALL: > * Ensure that the modulus size, when encoded, is at least 2048 bits, and; > * Ensure that the modulus size, in bits, is evenly divisible by 8. > For ECDSA key pairs, the CA SHALL: > * Ensure that the key represents a valid point on the NIST P-256, NIST P-384 or NIST P-521 elliptic curve. > No other algorithms or key sizes are permitted. * https://cabforum.org/uploads/CA-Browser-Forum-TLS-BRs-v2.0.2.pdf https://cabforum.org/uploads/CA-Browser-Forum-TLS-BRs-v2.0.2... * https://cabforum.org/working-groups/server/baseline-requirements/documents/ https://cabforum.org/working-groups/server/baseline-requirem... Ed25519 (and Ed448) was only 'recently' approved by NIST FIPS 186-5 in February 2023.
- GoblinSlayer 3y agoThen make your own CA.
- kwantam 3y agoEdDSA signatures are specified to use deterministic nonce generation, so you're correct that they do not require randomness. But they certainly do require modular arithmetic in order to implement the elliptic curve operations!
- 3y ago
- jacksonhacker 3y ago[dead]
- bdd8f1df777b 3y agoI knew requiring public key authentication *followed by* password authentication on my SSH server was not paranoid!
- pcdoodle 3y agoAre people using password only at risk?
- bdd8f1df777b 3y agoNot at this risk, but possibly others. Requiring both is always better.
- f3d46600-b66e 3y agoI suspect it won't help. If your key is compromised, the previous sessions are compromised as well. I.e. the attacker now knows the password.
- kbolino 3y agoThere is no indication or mention that key exchange was compromised. SSH has forward secrecy, so compromising the authentication keys does not compromise the encryption keys.
- EVa5I7bHFq9mnYK 3y agoI have keys that start with ssh-ed25519, made by puttygen. Are those safe?
- pigbearpig 3y agoThe answer is in the link. Sixth paragraph, right above the horizontal rule. Couldn't be clearer.
- beng-nl 3y agoTo those wondering: (Incidentally, none of this affects Ed25519. The spec for that system includes its own idea of how you should do deterministic nonce generation - completely different again, naturally - and we did it that way rather than our way, so that we could use the existing test vectors.)
- e79 3y agoI did a bit of a deep dive into this, in case anyone is interested. I think reading the code is a great way to understand _why_ this vulnerability happened: https://ericrafaloff.com/your-putty-generated-nist-p-521-keys-are-compromised/ https://ericrafaloff.com/your-putty-generated-nist-p-521-key...
- ki85squared 3y agoThank you. Your writeup helped make it click!
- Elucalidavah 3y agoYour title says "PuTTY-Generated" but the OP article says "The problem is not with how the key was originally generated; it doesn't matter whether it came from PuTTYgen or somewhere else. What matters is whether it was ever used with PuTTY or Pageant".
- e79 3y agoGood catch! I wrote the title before I had dug into the matter and forgot to update it. Thanks for pointing that out. Any k generation and subsequent signature generation are going to be impacted.
- Aachen 3y agoThe answer being, per that post: author was worried about low quality randomness on Windows and ran it through a sha512 hash function which outputs fewer than 521 bits so the remaining ones will be left zero
- e79 3y agoUpdated link with corrected title: https://ericrafaloff.com/biased-nonce-generation-in-putty-for-nist-p-521-keys/ https://ericrafaloff.com/biased-nonce-generation-in-putty-fo...
- Frezzia 3y ago[flagged]
- Frezzia 3y ago[flagged]
- Frezzia 3y ago[flagged]
- Frezzia 3y ago[flagged]
- Frezzia 3y ago[flagged]
- cyberpunk 3y agoOne time putty took down our prod rac cluster on Xmas eve, and I spent three days fixing it.. One of the on call engineers had copied some documentation to his clipboard which had like: Dbfile 1 location > /u01/ora/whatever And accidentally right clicked… I absolutely blame that software for ruining my Christmas one year, and I can’t really forgive it. Please use OpenSSH.
- chgs 3y agoBecause pasting in OpenSSH doesn’t work?
- tryauuum 3y agonowadays on my Linux terminal if I paste anything containing a newline (which in the past would cause the commands to execute) I get a pop up asking me to confirm Really saves you from the websites putting paragraphs of malicious code into seemingly a single simple line
- lmz 3y agoYou say that like an accidental middle click from e.g. xterm would be any better.
- djao 3y agoRecent gnome-terminal handles these much more safely. If you paste in a newline, whether from primary or clipboard, the terminal puts a newline into your command, but doesn't press enter for you.
- lmz 3y ago> terminal puts a newline into your command, but doesn't press enter for you. I'm having difficulty imagining this. I know of some who warn on multiline paste, but how exactly is it possible to "put a newline" but not "press enter"? Just emit a newline as output without sending as input?
- Helmut10001 3y agoIs there any way to check for how an SSH key was generated and with what type? ssh-keygen -l -f <file> Can be used to show the key's bit-size and fingerprint, but I am not sure whether I used Putty or ssh-keygen on Ubuntu/Debian for some of my SSH keys. Also, it would be nice if I would know the command to list key-types directly for keys unlocked in my ssh agent; not through a file (I use KeeAgent from KeyPass on Windows, linked through npiperelay into WSL1/WSL2).
- Symbiote 3y agoIt says the key may have been lost if it had ever been used with Putty. If you have keys of this type and have ever used Putty you should revoke them.
- Helmut10001 3y agoI use pageant as my SSH Agent and WSL to access it through ssh-agent. I only used to generate Keys with Putty, (Puttygen), but reverted to standard Linux `ssh-keygen` in the last 2-3 years. I am still wondering what the exact steps are to show the key type.
- ajb 3y agoYou can look in the key file. From the OP: "has an id starting ecdsa-sha2-nistp521 in [...] the key file" He also mentions some other places the information shows up.
- Helmut10001 3y agoAh, yes - there it is (in KeePass/KeeAgent, under `Advanced`, click on the private key file (*.ppk) and then on Open > Internal Viewer). > PuTTY-User-Key-File-2: ssh-rsa..Encryption: aes256-cbc Indeed I seem to have used Puttygen in the past. For keys from Linux ssh-keygen, the private key starts with: > -----BEGIN OPENSSH PRIVATE KEY----- and the public key starts with > ssh-ed25519
- Brybry 3y ago
- britmap 3y agoCVE-2024-31497
- jokoon 3y agoI LOATHE cybersecurity. I wish governments would have some kind of enforceable ISO standard on it, where it would be required by law for source code to be properly validated, either by a compiler or linter or by a third party, where an insurance company would be financially liable if a CVS is found. I feel like it is the only real way to improve cybersecurity in serious manner. There is so much software in the world that it has become a national security problem. Of course one issue with this, is that as long as the NSA is obviously a leader in cybersecurity, they would rather have software used outside of the US to be less secure, but with time, that strategy might also cause problems. I don't have a problem being spied on by western government, but if low security causes bad state actors or other criminal to cause problems, then that's bad.
- MaxBarraclough 3y agoYour points seem a little off topic as this isn't about proprietary payware with obvious security deficiencies. This is a subtle cryptographic issue in a high quality Free and Open Source software package. I agree though that market pressures aren't always enough to motivate adequate investment in cybersecurity. A recent case involving D-Link: https://news.ycombinator.com/item?id=39960107 https://news.ycombinator.com/item?id=39960107
- marcinzm 3y agoThat sounds like a great way to kill all OSS.
- pelorat 3y agoWhen WSL came out, I moved away from PuTTY/KiTTY in favor of simply using SSH in Windows Terminal via WSL.
- daedalus2027 3y agoFor the curious, an implementation of the attack: https://github.com/daedalus/BreakingECDSAwithLLL https://github.com/daedalus/BreakingECDSAwithLLL