PuTTY < 0.81 — Credential Theft
PuTTY generates biased ECDSA nonces when authenticating with NIST P-521 keys, allowing an attacker who observes enough signatures to recover the private key.
An attacker who can observe SSH authentication sessions (e.g., a network adversary, a compromised SSH server, or anyone with access to authentication logs) and collect approximately 60 signatures can perform a lattice attack to recover the private key. With the private key, they can authenticate as that user to any server that trusts it.
PuTTY versions before 0.81 generate predictably biased nonces when creating ECDSA signatures during SSH authentication using NIST P-521 keys. Approximately 60 signatures are sufficient for an attacker to recover the private key using the lattice-based attack. This affects any system where users authenticate to servers using ECDSA P-521 keys through PuTTY, including saved key files in PuTTYgen format.
Probably yes if any of these apply:
Affected OS versions
This vulnerability is particularly significant for system administrators who use ECDSA P-521 keys to authenticate to servers. If any of those servers have been compromised or are observable by an attacker, previously captured authentication traffic can be used to recover the private key retroactively.
Manual remediation steps
⏱ 20–30 minutesStep 1 — Check PuTTY Version
# Check PuTTY version
$putty = Get-ItemProperty 'HKLM:\SOFTWARE\SimonTatham\PuTTY' -ErrorAction SilentlyContinue
if ($putty) { $putty.Version } else { "PuTTY registry key not found — check installation" }
# Or check the binary directly
Get-Item 'C:\Program Files\PuTTY\putty.exe' -ErrorAction SilentlyContinue |
ForEach-Object { $_.VersionInfo.FileVersion }
Step 2 — Update PuTTY
Step 3 — Revoke Compromised Keys
If you used ECDSA P-521 keys with a vulnerable PuTTY version, those keys should be considered potentially compromised:
Verification
Get-Item 'C:\Program Files\PuTTY\putty.exe' | ForEach-Object { $_.VersionInfo.FileVersion }
# Must show 0.81 or later
No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.
References