4 ms·
It appears that some of this was designed in the late 90s/early aughts, when Windows didn't have a cryptographically-secure random number generator. PuTTY carr
by chasil 3y ago
It appears that some of this was designed in the late 90s/early aughts, when Windows didn't have a cryptographically-secure random number generator.
PuTTY carries its own formats from this time.
- gruez 3y agoYou don't need a CSPRNG to do SHA512, which their solution already incorporates.
- chasil 3y agoThis is the text from the original article. "For this reason, since PuTTY was developed on Windows before it had any cryptographic random number generator at all, PuTTY has always generated its k using a deterministic method, avoiding the need for random numbers at all."
- gruez 3y agoBoth my proposed naive method and the PuTTY implementation are deterministic. The only difference is how the primitives (eg. SHA-512) are combined.