search

cyd01 / KiTTY

:computer: KiTTY, a free telnet/ssh client for Windows
https://www.9bis.com/kitty
Other
1.54k stars 130 forks source link

CVE-2024-31497: Secret Key Recovery of NIST P-521 Private Keys Through Biased ECDSA Nonces in PuTTY Client #531

Open TrueSkrillor opened 2 months ago

TrueSkrillor commented 2 months ago

The vulnerability mentioned in the title also affects KiTTY as it is a modified version of PuTTY 0.76. Given the long-open vulnerabilities for KiTTY, I suspect that this will be the case here as well. Therefore, be advised not to use ECDSA NIST-P521 alongside KiTTY any longer. If you have been using it, rotate your keys to another algorithm (preferably ssh-ed25519).

More details regarding this vulnerability can be found here: https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-p521-bias.html

kev-pearce-sp commented 2 months ago

+1

wiesl commented 2 months ago

+1, see also here: https://www.openwall.com/lists/oss-security/2024/04/15/6

EirikBjarkoy commented 2 months ago

+1

vittoriop77 commented 2 months ago

+1

jesseorr commented 2 months ago

+1

Dubbeldrank commented 2 months ago

My trust in this project is gone, which is a shame because of the functionality. But it would be wise if the developer would archive this repository as it doesn't seems that anyone wants to continue this project. Many thanks for all the work you put into it over the years @cyd01

opbod commented 2 months ago

https://github.com/lalbornoz/PuTTie has released a version with a fix. Not there yet in terms of KiTTY features, but worth exploring.

mariuszjedrzejewski commented 1 month ago

https://github.com/lalbornoz/PuTTie has released a version with a fix. Not there yet in terms of KiTTY features, but worth exploring.

Font size change on ctrl + mouse-wheel! One of top useful KiTTy features is in PuTTie. @opbod, I owe you a beer.