Critical Crypto Bug Fixed in PuTTY

Many versions of the PuTTY client have a subtle vulnerability that can allow an attacker to compromise some private keys and then forge signatures and log into any remote servers on which those keys are used.

The bug affects versions 0.68-0.80 of PuTTY, a popular client used for SSH, Telnet, and other remote communication protocols, and derives from the fact that when using a specific NIST elliptic curve, the client produces biased ECDSA nonces. The weakness only applies to 521-bit …

attacker bug can client communication compromise critical crypto forge keys log popular private private keys putty servers signatures ssh telnet vulnerability