PuTTY 0.81 security release [LWN.net]

Version 0.81 of the PuTTY SSH client is out with a fix for CVE-2024-31497; some users will want to update and generate new keys:

PuTTY 0.81, released today, fixes a critical vulnerability CVE-2024-31497 in the use of 521-bit ECDSA keys (ecdsa-sha2-nistp521). If you have used a 521-bit ECDSA private key with any previous version of PuTTY, consider the private key compromised: remove the public key from authorized_keys files, and generate a new key pair.
However, this only affects that one algorithm and key size. No other size of ECDSA key is affected, and no other key type is affected.

(Thanks to Joe Nahmias).

to post comments

PuTTY 0.81 security release

Posted Apr 16, 2024 15:34 UTC (Tue) by makendo (guest, #168314) [Link] (10 responses)

They definitely meant 512-bit by 521-bit...

PuTTY 0.81 security release

Posted Apr 16, 2024 15:36 UTC (Tue) by intelfx (subscriber, #130118) [Link] (9 responses)

No, they meant exactly 521 bit.

PuTTY 0.81 security release

Posted Apr 16, 2024 16:04 UTC (Tue) by NYKevin (subscriber, #129325) [Link] (8 responses)

Indeed, the discrepancy between 512 and 521 is the source of the issue. I'm sure they are now very painfully aware of it.

PuTTY 0.81 security release

Posted Apr 16, 2024 16:17 UTC (Tue) by alanjwylie (subscriber, #4794) [Link] (1 responses)

$ for x in {512..521}; do factor $x; done
512: 2 2 2 2 2 2 2 2 2
513: 3 3 3 19
514: 2 257
515: 5 103
516: 2 2 3 43
517: 11 47
518: 2 7 37
519: 3 173
520: 2 2 2 5 13
521: 521

PuTTY 0.81 security release

Posted Apr 16, 2024 18:20 UTC (Tue) by bbolli (guest, #19153) [Link]

factor {512..521}

PuTTY 0.81 security release

Posted Apr 16, 2024 20:26 UTC (Tue) by jreiser (subscriber, #11027) [Link] (5 responses)

This reveals acutely the lack of basic sanity checking in the code. The error was much deeper than typographic. 512 is a power of 2 (an even prime), and 521 is a prime itself. Those two facts of number theory should stick out like two sore thumbs for any code that handles crypto. The integers 512 and 521 cannot possibly masquerade as each other.

PuTTY 0.81 security release

Posted Apr 16, 2024 20:53 UTC (Tue) by intelfx (subscriber, #130118) [Link] (4 responses)

> This reveals acutely the lack of basic sanity checking in the code. The error was much deeper than typographic. 512 is a power of 2 (an even prime), and 521 is a prime itself. Those two facts of number theory should stick out like two sore thumbs for any code that handles crypto. The integers 512 and 521 cannot possibly masquerade as each other.

I don't think that is relevant.

Reading the bulletin on the PuTTY project website, it seems the error was neither typographic nor number-theoretic. PuTTY used its own algorithm for deterministic nonces instead of the RFC (because that algorithm predated the RFC by 13 years), which used a 512-bit hash modulo the order of the ECC subgroup, and failed to account for the fact that the order in question might someday become larger than 512.

PuTTY 0.81 security release

Posted Apr 16, 2024 22:36 UTC (Tue) by ballombe (subscriber, #9523) [Link] (2 responses)

Indeed. 521 was chosen instead of 512 because 521 is a Mersenne prime:
p=2^521-1 is prime and reduction modulo p can be done with just one shift, one masking and one substraction.

See <https://www.secg.org/SEC2-Ver-1.0.pdf> page 18.

Putty just did not anticipated than one standard would use a modulo larger than 2^512.

PuTTY 0.81 security release

Posted Apr 17, 2024 5:36 UTC (Wed) by oldtomas (guest, #72579) [Link] (1 responses)

You meant to say 2^521 - 1 is a Mersenne prime (threw me of at first :-)

PuTTY 0.81 security release

Posted Apr 17, 2024 14:37 UTC (Wed) by Klaasjan (subscriber, #4951) [Link]

You probably meant to say ‘threw me off’ :)

PuTTY 0.81 security release

Posted Apr 17, 2024 16:59 UTC (Wed) by chris_se (subscriber, #99706) [Link]

> Reading the bulletin on the PuTTY project website, it seems the error was neither typographic nor number-theoretic. PuTTY used its own algorithm for deterministic nonces instead of the RFC (because that algorithm predated the RFC by 13 years), which used a 512-bit hash modulo the order of the ECC subgroup, and failed to account for the fact that the order in question might someday become larger than 512.

The git commit message that fixes this is actually quite enlightening:
https://git.tartarus.org/?p=simon/putty.git;a=commit;h=c1...

To me this shows that when you see some minor issue when implementing crypto, you better fix it regardless, because even if you are relatively sure that it's OK for now, it will come to bite you in the back at some later point in time.

Also, IMHO these kind of issues are another reason to avoid DSA/ECDSA. The fact that the signature is linearly dependent on a product of the private key and a nonce makes attacks such as these even remotely feasible. There are better alternatives available (e.g. EdDSA) that don't suffer from this underlying design issue in the basic algorithm.

PuTTY 0.81 security release

Posted Apr 17, 2024 10:49 UTC (Wed) by ciakval (subscriber, #140828) [Link]

It seems like the download page was not yet updated to 0.81, even though the link on the home page says so:
The latest version is 0.81. Download it here.

The files for the 0.81 version seem to be reachable from a 0.81 release page.