{"id":"4201959f-8e9a-4e48-8594-ade6d0633f16","arxiv_id":"2509.09331","paper_version":1,"verdict":"ACCEPT","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"low","formal_verification":"none","parameter_count":0,"one_line_summary":"PuTTY's deterministic ECDSA nonces for NIST P-521 are biased by nine bits, allowing private key recovery from 58 valid signatures (CVE-2024-31497).","lead":"This paper measures the real-world security of SSH client keys and signatures across 24 clients and 31.6 million public keys, and describes a new attack that recovers a PuTTY ECDSA P-521 private key from only 58 signatures. The attack, confirmed as CVE-2024-31497, shows that deterministic nonce generation can introduce the same kind of bias that random nonce flaws produce.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"No significant objection identified","rationale":"The reader's verdict is ACCEPT with moderate confidence. I find no load-bearing correctness or soundness concern in the paper's central claim. The nonce bias is derived directly from the deterministic kproto construction, the HNP formulation is textbook, and the experimental evidence is strong (1024 trials per point). The collection scenario (58 signatures from a controlled server) is indeed the least measured aspect, but the paper's contribution is the discovery and demonstration of a cryptographic vulnerability, not a large-scale exploitability estimate. The reader flagged this correctly as a standard threat model. The abstract's phrase 'can be recovered from just 58 valid signatures' is a slight simplification of the paper's probabilistic results (>0.5 at 58, always at 60), but the paper itself is explicit about the probabilities, so this is not a substantive flaw. Overall, no adjustment to the verdict is warranted.","tokens_in":558,"tokens_out":8850,"duration_ms":266422,"concrete_test":"Run the provided artifact (Zenodo 17008443) to generate PuTTY 0.80 ECDSA P-521 signatures, then run the recovery script on 10,000 independent signature sets at 58 and 60 signatures. Verify that the success rate at 58 is > 0.5 (ideally close to 0.5–0.6) and that the success rate at 60 is near 1.0, consistent with the paper's reported Figure 5.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim (PuTTY 0.80 ECDSA P-521 private key recovery from 58 signatures) is technically well-supported. The derivation of the 9-bit nonce bias is correct: kproto is 512 bits, q for P-521 exceeds 2^512, so k = kproto mod (q-2) + 2 is always < 2^512, leaving the top 9 bits zero. The HNP lattice attack uses standard techniques and is experimentally validated on 1024 trials per signature count. The weakest point is the attack's real-world preconditions: an adversary must collect at least 58 valid signatures from the same client key, which requires controlling/impersonating the SSH server or using agent forwarding. This is an unmeasured collection scenario, but it is a standard SSH threat model and does not undermine the existence or validity of the key-recovery attack. The paper's disclosure via CVE-2024-31497 and the availability of a reproducible artifact further support the findings.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper studies the security of SSH client authentication in two complementary parts. First, it reports a longitudinal measurement of 31,622,338 public keys collected from GitHub, GitLab, and Launchpad in June 2023 and January 2025, subjecting them to RSA batch GCD, short-key, small-factor, ROCA, Debian weak-key, Fermat, DSA/ECDSA/EdDSA validation, and upload-restriction tests. Second, it presents a black-box lab method for determining the nonce generation of SSH clients, using partial-success SSH authentication to obtain two signatures over an identical payload, and applies it to 24 clients and 14 agents. The central finding is that PuTTY 0.80's deterministic kproto nonce scheme, when used with NIST P-521 ECDSA, produces nonces confined to a 512-bit interval despite a 521-bit group order. The paper derives the resulting 9-bit bias, casts the signature equations as a Hidden Number Problem instance, and reports private-key recovery with probability ≥ 0.5 from 58 signatures and 1024/1024 success from 60 signatures, with CVE-2024-31497 and a fix in PuTTY 0.81. It also reports that AbsoluteTelnet and Tectia SSH enable agent forwarding by default.","tokens_in":26005,"tokens_out":7350,"duration_ms":74282,"significance":"The paper's contribution is substantial and, if correct, significant. The measurement part updates the field's picture of client key deployment and shows that platform upload filters are uneven and incomplete; the numbers are exact and the methodology is reusable. The PuTTY attack is the strongest result: it demonstrates that a deterministic nonce scheme can be dangerously biased even when implemented with a cryptographic hash, because the hash output width was not matched to the curve order. The derivation requires no fitted parameters, and the attack is validated externally with a standard lattice solver on 1024 trials per signature count. The availability of a Zenodo artifact, the CVE disclosure, and the vendor fix are explicit strengths. The main practical caveat—that collecting 58 signatures requires the adversary to be the SSH server or to control an agent-forwarding path—is clearly acknowledged in the paper and is within the standard SSH threat model; it does not undermine the technical claim.","major_comments":[],"minor_comments":[{"comment":"The statement that the upper nine most significant bits of the nonce are \"always zero\" is not strictly true for every possible value. Since k = kproto + 2, the single value kproto = 2^512 - 1 gives k = 2^512 + 1, whose bit 512 is set. The probability is 2^-512 and the attack is unaffected, but the wording should say \"with overwhelming probability\" or \"up to one value out of 2^512.\"","section":"§5.2, Eq. (3)-(4)"},{"comment":"The text says that \"from 60 signatures we can always compute the private signing key,\" but this is an empirical statement based on 1024/1024 successful trials. Please report a confidence interval or phrase as \"in all 1024 trials.\" The figure also lacks error bars or an explicit statement of trial count on the plot itself.","section":"§5.2, Figure 5"},{"comment":"For the three clients where two signatures on the same payload could not be captured, the text says \"we could not determine whether deterministic nonces are used\" but then immediately says \"we can rule out either one using kproto or RFC 6979.\" This is confusing: if no repeated signature can be elicited, what evidence rules out these two schemes? Please clarify the reasoning or present it as a weaker statement.","section":"§5.1, Table 4"},{"comment":"In the version reviewed, Table 3 is garbled: the header row is repeated, and the Launchpad column appears to be missing from the rendered table. Ensure the camera-ready version has all three platform columns and a clear mapping of symbols to results.","section":"Table 3"}],"recommendation":"minor_revision","confidential_remarks":"This is a technically sound paper with no load-bearing errors. The stress-test concern about the unmeasured signature-collection scenario does not land as a major objection because the paper situates the attack in the malicious-server/agent-forwarding threat model and does not overclaim passive-network applicability. The remaining issues are exactness of wording and presentation, hence minor revision. The artifact and 1024-trial validation are strong positives."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: the PuTTY P-521 key-recovery attack is the real result, and it holds up. The paper derives a 9-bit zero bias from the kproto construction (SHA-512 output reduced modulo q-2 where q is P-521's order, so k < 2^512), then uses an existing HNP lattice solver to recover the private key from 58 signatures with >0.5 success and 60 always, over 1024 trials. That's a clean, reproducible result, and the CVE is acknowledged. The rest of the paper – a two-scan collection of 31.6M SSH client keys from GitHub, GitLab, and Launchpad, plus a lab survey of nonce generation in 24 SSH clients – is a solid piece of measurement work even if none of the individual weak-key tests are new. The novelty is in the scale, the two-point comparison, the systematization of upload restrictions, and the black-box trick of forcing a client to re-authenticate in the same session to expose deterministic nonces.\n\nSoft spots, in proportion:\n\n- The attack's real-world preconditions matter: an attacker needs 58 valid signatures under the same key, and since client signatures ride inside the encrypted SSH channel, that generally means the attacker controls the SSH server or can abuse agent forwarding. The paper demonstrates harvesting in the lab but doesn't quantify how often victims would hit 58 signatures with a hostile endpoint. That's a limitation but not a fatal one; it's the standard SSH threat model and the paper says so.\n\n- The longitudinal key study is a convenience sample of users who publish keys on public forges, not a random sample of SSH clients. The authors acknowledge this and the conclusion is appropriately hedged.\n\n- The raw key database is withheld for privacy and safety reasons; that limits independent verification, but the artifact includes all the tooling and the choice is defensible.\n\nI don't see a load-bearing flaw. The math is simple and correct, the experiments are described with enough detail to reproduce, and the disclosure was responsible. The paper is probably more valuable to protocol and crypto-engineering audiences than to pure measurement researchers, but it deserves a serious referee.\n\nRecommendation: yes, send it to peer review.","headline":"Solid, well-supported attack on PuTTY's P-521 deterministic nonces, plus a useful if not revolutionary longitudinal key survey; the exploit's preconditions are real but the paper doesn't oversell them.","tokens_in":26485,"tokens_out":2000,"would_cite":true,"duration_ms":22595,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"PuTTY's deterministic ECDSA nonce generator biases nonces for the P-521 curve, and the paper shows how an attacker can recover the private signing key from only 58 observed signatures.","keywords":["SSH client authentication","ECDSA nonce bias","deterministic nonce","PuTTY","Hidden Number Problem","lattice attack","RSA weak keys","longitudinal key measurement"],"falsifier":"Collect 60 ECDSA P-521 signatures from a known PuTTY 0.80 test key, run the paper's lattice-based recovery, and check whether the private key is recovered; if not, the bias claim or the threshold is wrong. A simpler direct check: any single PuTTY 0.80 P-521 signature with a non-zero bit among the top nine bits of its nonce would refute the bias.","tokens_in":25718,"feed_emoji":"🔑","tokens_out":5269,"duration_ms":47638,"temperature":0.7,"pith_summary":"This paper measures the security of SSH client signatures at scale by collecting over 31 million public SSH keys from code-hosting platforms and testing them for known weaknesses, and it analyzes the signature implementations of 24 SSH clients in the lab. The central finding is that PuTTY versions 0.80 and earlier generated ECDSA nonces with a hidden bias when signing with the P-521 curve: the top nine bits of each nonce are always zero. From that bias, the paper shows how to reconstruct the private signing key from a small number of observed signatures—58 signatures with probability above one half, and 60 signatures in every trial. If correct, this means any SSH server that a PuTTY P-521 user connects to, or any agent-forwarding proxy, can silently recover the user's private key. The paper also reports that two SSH clients enable agent forwarding by default, turning every server into a signing oracle for the user's key.","feed_headline":"58 signatures recover a PuTTY P-521 private key","feed_subtitle":"A hidden 9-bit bias in PuTTY's deterministic nonces lets any server with enough samples reconstruct the ECDSA signing key.","key_machinery":"The central object is kproto, PuTTY's custom deterministic nonce generator: k = (SHA-512(label || x || H(m)) mod (q-2)) + 2, where x is the private key. For curves whose order q is at most 512 bits, the reduction hides the bias; for P-521, q > 2^512, so the SHA-512 output is taken without reduction and k is always < 2^512, giving a 9-bit bias. The attack mechanism is the Hidden Number Problem: from each signature (r,s), the attacker computes t = s^{-1} r and b = s^{-1} H(m) and obtains a relation t·a + b = k (mod q) with a partially known k, then recovers the hidden scalar a (the private key) via lattice reduction. The paper's new measurement technique—forcing a client to sign the same paylo","core_discovery":"The paper's main new attack targets PuTTY's deterministic nonce scheme, kproto, which derives the ECDSA nonce as a SHA-512 hash over a label, the private key, and the message hash, then reduces it to the interval [2, q-2]. For the P-521 curve, the group order q exceeds 2^512, so the SHA-512 output is never reduced and every nonce is smaller than 2^512, leaving the nine most significant bits fixed at zero. Rewriting the ECDSA signature equation as t·a + b = k (mod q) turns each signature into an instance of the Hidden Number Problem, and a lattice-based solver recovers the scalar a (the private key) from a modest number of such biased signatures. The authors evaluate the attack on PuTTY 0.80","pith_inferences":["The same partial-success technique could be turned into a proactive server-side audit: a server could legitimately trigger repeated authentication to measure client nonce bias, though this would require user consent.","The 9-bit bias stems from the alignment of SHA-512 with P-521; other combinations of hash output length and curve order deserve scrutiny, especially as new curves are standardized.","Because client signatures travel inside an encrypted tunnel, the practical attacker model is not a passive eavesdropper but an active server; this shifts the threat model from network monitoring to endpoint trust, where agent-forwarding defaults become the more dangerous factor.","The longitudinal key data suggest a transition to Ed25519, which is deterministic and not vulnerable to this class of nonce bias; if this trend continues, the practical window for nonce-bias attacks on SSH clients may be closing for new deployments, though existing ECDSA keys remain at risk."],"forward_implications":["Users of PuTTY 0.80 or earlier who have used an ECDSA P-521 key should treat that key as compromised and revoke it, even if no attack has been observed.","The attack works against any server that collects enough signatures, such as a malicious SSH server, a jump host with agent forwarding, or a platform that records authentication signatures.","Deterministic nonce schemes are not automatically safe; implementers should use RFC 6979, which produces nonces of the full required length, and should audit any scheme that reduces a fixed-length hash to a curve order.","The paper's black-box nonce-detection method can be applied to other clients and future versions to screen for similar biases without source code access.","Platforms that enforce public-key upload checks (as the paper evaluates) show measurably fewer weak keys, suggesting such filters reduce exposure."],"fun_headline_variants":["PuTTY P-521 key broken from 58 deterministic signatures","9-bit nonce bias lets 58 signatures leak PuTTY private key","PuTTY's deterministic nonces crack P-521 ECDSA from 58 sigs","58 ECDSA signatures expose PuTTY P-521 private key","Hidden bias in PuTTY nonce allows key theft from 58 signatures"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The attack requires an adversary to collect at least 58 valid ECDSA P-521 signatures created with the same PuTTY key, and because these signatures are only sent inside the encrypted SSH channel, the adversary must control the SSH server or obtain agent-forwarding access; the paper demonstrates the collection in a lab but does not measure how often real users would generate that many signatures to a hostile endpoint.","fun_headline_variants_meta":{"raw":{"variants":["PuTTY P-521 key broken from 58 deterministic signatures","9-bit nonce bias lets 58 signatures leak PuTTY private key","PuTTY's deterministic nonces crack P-521 ECDSA from 58 sigs","58 ECDSA signatures expose PuTTY P-521 private key","Hidden bias in PuTTY nonce allows key theft from 58 signatures"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00038,"raw_usage":{"total_tokens":1924,"prompt_tokens":882,"completion_tokens":1042,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":626,"completion_tokens_details":{"reasoning_tokens":940}},"tokens_in":626,"tokens_out":1042,"duration_ms":7259,"temperature":1.0,"reasoning_tokens":940,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-04T19:15:32.662894+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Collect 60 ECDSA P-521 signatures from a known PuTTY 0.80 test key, run the paper's lattice-based recovery, and check whether the private key is recovered; if not, the bias claim or the threshold is wrong. A simpler direct check: any single PuTTY 0.80 P-521 signature with a non-zero bit among the top nine bits of its nonce would refute the bias.","supporting_citations":[],"review_version":1}