Pith. sign in

REVIEW 4 minor 69 references

On the Security of SSH Client Signatures

T0 review · 0 major / 4 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read PuTTY's deterministic ECDSA nonce generator biases nonces for the P-521 curve, and the paper shows how an attacker can recover the private signing key from only 58 observed signatures.

desk verdict Solid, well-supported attack on PuTTY's P-521 deterministic nonces, plus a useful if not revolutionary longitudinal key survey; the exploit's preconditions are real but the paper doesn't oversell them. read the letter →

arxiv 2509.09331 v1 pith:JWD4ZPCM submitted 2025-09-11 cs.CR

Fabian Bäumer , Marcus Brinkmann , Maximilian Radoy , Jörg Schwenk , Juraj Somorovsky This is my paper
classification cs.CR
keywords SSHclientauthenticationECDSAnoncebiasdeterministicPuTTYHiddenNumberProblemlatticeattackRSAweakkeyslongitudinalkeymeasurement
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper measures the security of SSH client signatures at scale by collecting over 31 million public SSH keys from code-hosting platforms and testing them for known weaknesses, and it analyzes the signature implementations of 24 SSH clients in the lab. The central finding is that PuTTY versions 0.80 and earlier generated ECDSA nonces with a hidden bias when signing with the P-521 curve: the top nine bits of each nonce are always zero. From that bias, the paper shows how to reconstruct the private signing key from a small number of observed signatures—58 signatures with probability above one half, and 60 signatures in every trial. If correct, this means any SSH server that a PuTTY P-521 user connects to, or any agent-forwarding proxy, can silently recover the user's private key. The paper also reports that two SSH clients enable agent forwarding by default, turning every server into a signing oracle for the user's key.

What carries the argument

The central object is kproto, PuTTY's custom deterministic nonce generator: k = (SHA-512(label || x || H(m)) mod (q-2)) + 2, where x is the private key. For curves whose order q is at most 512 bits, the reduction hides the bias; for P-521, q > 2^512, so the SHA-512 output is taken without reduction and k is always < 2^512, giving a 9-bit bias. The attack mechanism is the Hidden Number Problem: from each signature (r,s), the attacker computes t = s^{-1} r and b = s^{-1} H(m) and obtains a relation t·a + b = k (mod q) with a partially known k, then recovers the hidden scalar a (the private key) via lattice reduction. The paper's new measurement technique—forcing a client to sign the same paylo

What would settle it

Collect 60 ECDSA P-521 signatures from a known PuTTY 0.80 test key, run the paper's lattice-based recovery, and check whether the private key is recovered; if not, the bias claim or the threshold is wrong. A simpler direct check: any single PuTTY 0.80 P-521 signature with a non-zero bit among the top nine bits of its nonce would refute the bias.

Watch

Extended reading notes

Core claim

The paper's main new attack targets PuTTY's deterministic nonce scheme, kproto, which derives the ECDSA nonce as a SHA-512 hash over a label, the private key, and the message hash, then reduces it to the interval [2, q-2]. For the P-521 curve, the group order q exceeds 2^512, so the SHA-512 output is never reduced and every nonce is smaller than 2^512, leaving the nine most significant bits fixed at zero. Rewriting the ECDSA signature equation as t·a + b = k (mod q) turns each signature into an instance of the Hidden Number Problem, and a lattice-based solver recovers the scalar a (the private key) from a modest number of such biased signatures. The authors evaluate the attack on PuTTY 0.80

Load-bearing premise

The attack requires an adversary to collect at least 58 valid ECDSA P-521 signatures created with the same PuTTY key, and because these signatures are only sent inside the encrypted SSH channel, the adversary must control the SSH server or obtain agent-forwarding access; the paper demonstrates the collection in a lab but does not measure how often real users would generate that many signatures to a hostile endpoint.

Editorial extensions

If this is right

  • Users of PuTTY 0.80 or earlier who have used an ECDSA P-521 key should treat that key as compromised and revoke it, even if no attack has been observed.
  • The attack works against any server that collects enough signatures, such as a malicious SSH server, a jump host with agent forwarding, or a platform that records authentication signatures.
  • Deterministic nonce schemes are not automatically safe; implementers should use RFC 6979, which produces nonces of the full required length, and should audit any scheme that reduces a fixed-length hash to a curve order.
  • The paper's black-box nonce-detection method can be applied to other clients and future versions to screen for similar biases without source code access.
  • Platforms that enforce public-key upload checks (as the paper evaluates) show measurably fewer weak keys, suggesting such filters reduce exposure.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same partial-success technique could be turned into a proactive server-side audit: a server could legitimately trigger repeated authentication to measure client nonce bias, though this would require user consent.
  • The 9-bit bias stems from the alignment of SHA-512 with P-521; other combinations of hash output length and curve order deserve scrutiny, especially as new curves are standardized.
  • Because client signatures travel inside an encrypted tunnel, the practical attacker model is not a passive eavesdropper but an active server; this shifts the threat model from network monitoring to endpoint trust, where agent-forwarding defaults become the more dangerous factor.
  • The longitudinal key data suggest a transition to Ed25519, which is deterministic and not vulnerable to this class of nonce bias; if this trend continues, the practical window for nonce-bias attacks on SSH clients may be closing for new deployments, though existing ECDSA keys remain at risk.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

0 major / 4 minor

Summary. This paper studies the security of SSH client authentication in two complementary parts. First, it reports a longitudinal measurement of 31,622,338 public keys collected from GitHub, GitLab, and Launchpad in June 2023 and January 2025, subjecting them to RSA batch GCD, short-key, small-factor, ROCA, Debian weak-key, Fermat, DSA/ECDSA/EdDSA validation, and upload-restriction tests. Second, it presents a black-box lab method for determining the nonce generation of SSH clients, using partial-success SSH authentication to obtain two signatures over an identical payload, and applies it to 24 clients and 14 agents. The central finding is that PuTTY 0.80's deterministic kproto nonce scheme, when used with NIST P-521 ECDSA, produces nonces confined to a 512-bit interval despite a 521-bit group order. The paper derives the resulting 9-bit bias, casts the signature equations as a Hidden Number Problem instance, and reports private-key recovery with probability ≥ 0.5 from 58 signatures and 1024/1024 success from 60 signatures, with CVE-2024-31497 and a fix in PuTTY 0.81. It also reports that AbsoluteTelnet and Tectia SSH enable agent forwarding by default.

Significance. The paper's contribution is substantial and, if correct, significant. The measurement part updates the field's picture of client key deployment and shows that platform upload filters are uneven and incomplete; the numbers are exact and the methodology is reusable. The PuTTY attack is the strongest result: it demonstrates that a deterministic nonce scheme can be dangerously biased even when implemented with a cryptographic hash, because the hash output width was not matched to the curve order. The derivation requires no fitted parameters, and the attack is validated externally with a standard lattice solver on 1024 trials per signature count. The availability of a Zenodo artifact, the CVE disclosure, and the vendor fix are explicit strengths. The main practical caveat—that collecting 58 signatures requires the adversary to be the SSH server or to control an agent-forwarding path—is clearly acknowledged in the paper and is within the standard SSH threat model; it does not undermine the technical claim.

minor comments (4)
  1. [§5.2, Eq. (3)-(4)] The statement that the upper nine most significant bits of the nonce are "always zero" is not strictly true for every possible value. Since k = kproto + 2, the single value kproto = 2^512 - 1 gives k = 2^512 + 1, whose bit 512 is set. The probability is 2^-512 and the attack is unaffected, but the wording should say "with overwhelming probability" or "up to one value out of 2^512."
  2. [§5.2, Figure 5] The text says that "from 60 signatures we can always compute the private signing key," but this is an empirical statement based on 1024/1024 successful trials. Please report a confidence interval or phrase as "in all 1024 trials." The figure also lacks error bars or an explicit statement of trial count on the plot itself.
  3. [§5.1, Table 4] For the three clients where two signatures on the same payload could not be captured, the text says "we could not determine whether deterministic nonces are used" but then immediately says "we can rule out either one using kproto or RFC 6979." This is confusing: if no repeated signature can be elicited, what evidence rules out these two schemes? Please clarify the reasoning or present it as a weaker statement.
  4. [Table 3] In the version reviewed, Table 3 is garbled: the header row is repeated, and the Launchpad column appears to be missing from the rendered table. Ensure the camera-ready version has all three platform columns and a clear mapping of symbols to results.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the PuTTY key-recovery result is derived from the public algorithm and validated against an external lattice solver.

full rationale

The paper's central security claim is that PuTTY 0.80's deterministic ECDSA P-521 nonce generation produces a 9-bit bias and that this bias permits private-key recovery from about 58 signatures. The derivation is self-contained and does not assume the conclusion. The nonce formula is quoted directly from PuTTY source: kproto is SHA-512-based, k = (kproto mod (q-2)) + 2, and for P-521 the group order q is about 521 bits while kproto is 512 bits, so k < 2^512 and the upper nine bits are always zero. This is a mathematical consequence of the algorithm, not a fitted parameter. The hidden-number-problem reduction is standard algebra (s = k^{-1}(h + a r) mod q rewritten as t a + b = k mod q), and the solver USVPPredSieve is an external tool by Albrecht and Heninger, not a result of this paper's authors. The success rates at 58/60 signatures are experimentally measured over 1024 trials per signature count, so they are empirical evidence rather than a renamed input. The real-world preconditions (needing a malicious or impersonated SSH server, or agent forwarding, to collect signatures) are discussed in the paper and acknowledged in the reader's note, but a challenging collection scenario is a threat-model limitation, not circular reasoning. There are self-citations (e.g., the Terrapin paper [9] in related work and the acknowledgment of a thesis for the scraper), but none is load-bearing for the key-recovery derivation. No step in the paper fits a target result as an input, and no 'prediction' is forced by construction. Therefore the circularity score is 0.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

The paper introduces no free parameters and no invented entities. It depends on standard ECDSA/HNP mathematics, an external lattice solver, a code-level fact about PuTTY's nonce generation, the SSH protocol assumption that a server can collect signatures, and the representativeness of Git-platform keys. The ledger captures these upstream commitments.

assumptions (5)
  • standard math ECDSA signature relation and the derived HNP equation t*a + b ≡ k (mod q) transform biased nonce observations into lattice instances.
    Used in Section 5.2 to reduce the PuTTY key recovery to the Hidden Number Problem; this is standard ECDSA algebra.
  • domain assumption The external lattice solver USVPPredSieve [2] correctly solves the HNP for the measured 9-bit bias with the claimed success rates.
    The paper does not re-derive the solver; success is established empirically in Figure 5 with 1024 trials per count.
  • domain assumption PuTTY 0.80's kproto implementation matches the described formula, with SHA-512 output fed directly as the nonce for P-521 without full reduction.
    The 9-zero-bit bias in Section 5.2 follows from this code-level fact, which the paper supports by source citation and statistical testing.
  • domain assumption The SSH server receives the client's USERAUTH signature and can legitimately trigger repeated signatures via partial authentication success, making a malicious server a viable signature collector.
    Underlies the black-box sampling method of Section 3.4 and the real-world threat model; the paper does not quantify real-world signature collection rates.
  • domain assumption Public keys on GitHub, GitLab, and Launchpad represent the broader population of SSH client keys.
    Supports the longitudinal claims in Section 4; the authors note in Section 5.1 that bundled Git clients may bias client-version distributions.

how reviews work

0 comments
Cite this review

Pith. "Pith review of On the Security of SSH Client Signatures." pith.science (2026). https://pith.science/paper/JWD4ZPCM

@misc{pith2026250909331,
  author       = {Pith},
  title        = {Pith review of: On the Security of SSH Client Signatures},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JWD4ZPCM}},
  note         = {Machine review of arXiv:2509.09331}
}
read the original abstract

Administrators and developers use SSH client keys and signatures for authentication, for example, to access internet backbone servers or to commit new code on platforms like GitHub. However, unlike servers, SSH clients cannot be measured through internet scans. We close this gap in two steps. First, we collect SSH client public keys. Such keys are regularly published by their owners on open development platforms like GitHub and GitLab. We systematize previous non-academic work by subjecting these keys to various security tests in a longitudinal study. Second, in a series of black-box lab experiments, we analyze the implementations of algorithms for SSH client signatures in 24 popular SSH clients for Linux, Windows, and macOS. We extracted 31,622,338 keys from three public sources in two scans. Compared to previous work, we see a clear tendency to abandon RSA signatures in favor of EdDSA signatures. Still, in January 2025, we found 98 broken short keys, 139 keys generated from weak randomness, and 149 keys with common or small factors-the large majority of the retrieved keys exposed no weakness. Weak randomness can not only compromise a secret key through its public key, but also through signatures. It is well-known that a bias in random nonces in ECDSA can reveal the secret key through public signatures. For the first time, we show that the use of deterministic nonces in ECDSA can also be dangerous: The private signing key of a PuTTY client can be recovered from just 58 valid signatures if ECDSA with NIST curve P-521 is used. PuTTY acknowledged our finding in CVE-2024-31497, and they subsequently replaced the nonce generation algorithm.

Figures

Figures reproduced from arXiv: 2509.09331 by the authors.

Figure 1
Figure 1. The SSH client ecosystem. (1) The user connects an SSH client to a proxy server, intending to connect to a server only [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Typical SSH handshake using a finite-field Diffie [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. The relative distribution of RSA modulus bit lengths [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: The only other curve in our dataset is NIST P-384, with a [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 4
Figure 4. Figure 4: The relative distribution of curves used with ECDSA [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: Success rate of the biased nonce attack on PuTTY [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

69 extracted references · 8 canonical work pages

  1. [1]

    Albrecht, Jean Paul Degabriele, Torben Brandt Hansen, and Kenneth G

    Martin R. Albrecht, Jean Paul Degabriele, Torben Brandt Hansen, and Kenneth G. Paterson. 2016. A Surfeit of SSH Cipher Suites. InACM CCS 2016, Edgar R. Weippl, Stefan Katzenbeisser, Christopher Kruegel, Andrew C. Myers, and Shai Halevi (Eds.). ACM Press, Vienna, Austria, 1480–1491. https://doi.org/10.1145/2976749. 2978364

    doi:10.1145/2976749 2016

  2. [2]

    Lattice Barrier

    Martin R. Albrecht and Nadia Heninger. 2021. On Bounded Distance Decoding with Predicate: Breaking the “Lattice Barrier” for the Hidden Number Problem. In EUROCRYPT 2021, Part I (LNCS, Vol. 12696) , Anne Canteaut and François- Xavier Standaert (Eds.). Springer, Cham, Switzerland, Zagreb, Croatia, 528–558. https://doi.org/10.1007/978-3-030-77870-5_19

    work page doi:10.1007/978-3-030-77870-5_19 2021

  3. [3]

    Albrecht, Kenneth G

    Martin R. Albrecht, Kenneth G. Paterson, and Gaven J. Watson. 2009. Plaintext Recovery Attacks against SSH. In 2009 IEEE Symposium on Security and Privacy . IEEE Computer Society Press, Oakland, CA, USA, 16–26. https://doi.org/10.1109/ SP.2009.5

    2009

  4. [4]

    Nils Amiet and Yolan Romailler. 2018. Reaping and breaking keys at scale: when crypto meets big data. Presented at DEF CON 2018. https://research.kudelskisecurity.com/wp-content/uploads/2018/08/amiet- romailler-reaping-keys-final-slides.pdf accessed: 2025-09-09

    2018

  5. [5]

    Christian Aumüller, Peter Bier, Wieland Fischer, Peter Hofreiter, and Jean-Pierre Seifert. 2003. Fault Attacks on RSA with CRT: Concrete Results and Practical Countermeasures. In CHES 2002 (LNCS, Vol. 2523) , Burton S. Kaliski, Jr., Çetin Kaya Koç, and Christof Paar (Eds.). Springer Berlin Heidelberg, Germany, Red- wood Shores, CA, USA, 260–275. https://d...

    work page doi:10.1007/3-540-36400-5_20 2003

  6. [6]

    Mihai Barbulescu, Adrian Stratulat, Vlad Traista-Popescu, and Emil Simion. 2016. RSA Weak Public Keys Available on the Internet. In Innovative Security Solutions for Information Technology and Communications , Ion Bica and Reza Reyhanitabar (Eds.). Springer International Publishing, Cham, 92–102

    2016

  7. [7]

    Elaine Barker. 2006. Recommendation for Obtaining Assurances for Digital Sig- nature Applications. Technical Report NIST Special Publication (SP) 800-89. National Institute of Standards and Technology, Gaithersburg, MD. https: //doi.org/10.6028/NIST.SP.800-89

    work page doi:10.6028/nist.sp.800-89 2006

  8. [8]

    Elaine Barker. 2018. Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography . Technical Report NIST Special Publica- tion (SP) 800-56a. National Institute of Standards and Technology, Gaithersburg, MD. https://doi.org/10.6028/NIST.SP.800-56Ar3

    doi:10.6028/nist.sp.800-56ar3 2018

Show all 69 references
  1. [9]

    Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk. 2024. Terrapin Attack: Breaking SSH Channel Integrity By Sequence Number Manipulation. In USENIX Security 2024, Davide Balzarotti and Wenyuan Xu (Eds.). USENIX Association, Philadelphia, PA, USA. https://www.usenix.org/confere...

    2024

  2. [10]

    Mihir Bellare, Tadayoshi Kohno, and Chanathip Namprempre. 2002. Authenti- cated Encryption in SSH: Provably Fixing The SSH Binary Packet Protocol. In ACM CCS 2002, Vijayalakshmi Atluri (Ed.). ACM Press, Washington, DC, USA, 1–11. https://doi.org/10.1145/586110.586112

    2002

  3. [11]

    Luciano Bello. 2008. CVE-2008-0166. Available from MITRE, CVE-ID CVE-2008-

    2008

  4. [12]

    Daniel J Bernstein. 2004. How to find smooth parts of integers. https://cr.yp.to/ papers.html#smoothparts accessed: 2025-04-14

    2004

  5. [13]

    Karthikeyan Bhargavan and Gaëtan Leurent. 2016. Transcript Collision Attacks: Breaking Authentication in TLS, IKE and SSH. InNDSS 2016. The Internet Society, San Diego, CA, USA. https://doi.org/10.14722/ndss.2016.23418

    2016

  6. [14]

    Denis Bider. 2018. Extension Negotiation in the Secure Shell (SSH) Protocol. RFC

    2018

  7. [15]

    Hanno Böck. 2023. Fermat Factorization in the Wild. Cryptology ePrint Archive, Report 2023/026. https://eprint.iacr.org/2023/026

    2023

  8. [16]

    DeMillo, and Richard J

    Dan Boneh, Richard A. DeMillo, and Richard J. Lipton. 2001. On the Importance of Eliminating Errors in Cryptographic Computations. Journal of Cryptology 14, 2 (March 2001), 101–119. https://doi.org/10.1007/s001450010016

    2001 doi

  9. [17]

    Dan Boneh and Ramarathnam Venkatesan. 1996. Hardness of Computing the Most Significant Bits of Secret Keys in Diffie-Hellman and Related Schemes. In CRYPTO’96 (LNCS, Vol. 1109), Neal Koblitz (Ed.). Springer Berlin Heidelberg, Germany, Santa Barbara, CA, USA, 129–142. https://d...

    1996 doi

  10. [18]

    Fabrice Boudot, Pierrick Gaudry, Aurore Guillevic, Nadia Heninger, Emmanuel Thomé, and Paul Zimmermann. 2019. 795-bit factoring and discrete logarithms. https://caramba.loria.fr/dlp240-rsa240.txt accessed: 2025-04-14

    2019

  11. [19]

    Fabrice Boudot, Pierrick Gaudry, Aurore Guillevic, Nadia Heninger, Emmanuel Thomé, and Paul Zimmermann. 2020. Factorization of RSA-250. https://sympa. inria.fr/sympa/arc/cado-nfs/2020-02/msg00001.html accessed: 2025-04-14

    2020

  12. [20]

    Joachim Breitner and Nadia Heninger. 2019. Biased Nonce Sense: Lattice At- tacks Against Weak ECDSA Signatures in Cryptocurrencies. In FC 2019 (LNCS, Vol. 11598), Ian Goldberg and Tyler Moore (Eds.). Springer, Cham, Switzerland, Frigate Bay, St. Kitts and Nevis, 3–20. https://...

    2019 doi

  13. [21]

    Weiqiong Cao, Hongsong Shi, Hua Chen, Jiazhe Chen, Limin Fan, and Wenling Wu. 2022. Lattice-Based Fault Attacks on Deterministic Signature Schemes of ECDSA and EdDSA. In CT-RSA 2022 (LNCS, Vol. 13161), Steven D. Galbraith (Ed.). Springer, Cham, Switzerland, Virtual Event, 169–...

    doi

  14. [22]

    Ben Cartwright-Cox. 2015. Auditing GitHub users’ SSH key quality. https: //blog.benjojo.co.uk/post/auditing-github-users-keys accessed: 2025-04-14

    2015

  15. [23]

    Lily Chen, Dustin Moody, Karen Randall, Andrew Regenscheid, and Angela Robinson. 2023. Recommendations for Discrete Logarithm-based Cryptography: Elliptic Curve Domain Parameters. https://doi.org/10.6028/NIST.SP.800-186

    2023 doi

  16. [24]

    Cryptosense. 2015. Batch-GCDing GitHub SSH Keys. https://web.archive.org/ web/20161119145246/https://cryptosense.com/batch-gcding-github-ssh-keys/ accessed: 2025-04-14

    2015

  17. [25]

    Wei Dai. 2002. email to IETF mailing list. https://www.ietf.org/ietf-ftp/ietf-mail- archive/secsh/2002-02.mail accessed: 2025-09-09

    2002

  18. [26]

    Hal Finney. 2006. Bleichenbacher’s RSA signature forgery based on implementation error. https://mailarchive.ietf.org/arch/msg/openpgp/ 5rnE9ZRN1AokBVj3VqblGlP63QE accessed: 2025-07-23

    2006

  19. [27]

    Paul Fiterău-Broştean, Toon Lenaerts, Erik Poll, Joeri de Ruiter, Frits Vaan- drager, and Patrick Verleg. 2017. Model learning and model checking of SSH implementations. In Proceedings of the 24th ACM SIGSOFT International SPIN Symposium on Model Checking of Software (Santa Ba...

    2017

  20. [28]

    CA/Browser Forum. 2024. Baseline Requirements for the Issuance and Manage- ment of Publicly-Trusted TLS Server Certificates. https://cabforum.org/working- groups/server/baseline-requirements/documents/CA-Browser-Forum-TLS- BR-2.1.2.pdf accessed: 2025-04-14

    2024

  21. [29]

    Oliver Gasser, Ralph Holz, and Georg Carle. 2014. A deeper understanding of SSH: Results from Internet-wide scans. In2014 IEEE Network Operations and Man- agement Symposium (NOMS). 1–9. https://doi.org/10.1109/NOMS.2014.6838249

    2014

  22. [30]

    GitHub, Inc. 2025. Using SSH agent forwarding. https://docs.github.com/en/ authentication/connecting-to-github-with-ssh/using-ssh-agent-forwarding ac- cessed: 2025-04-14

    2025

  23. [31]

    Artem Golubin. 2019. Public SSH keys can leak your private infrastructure. https://rushter.com/blog/public-ssh-keys/ accessed: 2025-09-09

    2019

  24. [32]

    Marcella Hastings, Joshua Fried, and Nadia Heninger. 2016. Weak Keys Remain Widespread in Network Devices. In Proceedings of the 2016 Internet Measurement Conference (Santa Monica, California, USA) (IMC ’16). Association for Computing Machinery, New York, NY, USA, 49–63. https...

    2016

  25. [33]

    Alex Halderman

    Nadia Heninger, Zakir Durumeric, Eric Wustrow, and J. Alex Halderman. 2012. Mining Your Ps and Qs: Detection of Widespread Weak Keys in Network Devices. In USENIX Security 2012 , Tadayoshi Kohno (Ed.). USENIX Association, Belle- vue, WA, USA, 205–220. https://www.usenix.org/co...

    2012

  26. [34]

    RSA Security Inc. 1994. RSA Challenge List. http://www.ontko.com/pub/rayo/ primes/rsa_fact.html accessed: 2025-04-14

    1994

  27. [35]

    Liz Izhikevich, Renata Teixeira, and Zakir Durumeric. 2021. LZR: Identifying Unexpected Internet Services. InUSENIX Security 2021, Michael Bailey and Rachel Greenstadt (Eds.). USENIX Association, 3111–3128. https://www.usenix.org/ conference/usenixsecurity21/presentation/izhikevich

    2021

  28. [36]

    Mobin Javed and Vern Paxson. 2013. Detecting stealthy, distributed SSH brute- forcing. In ACM CCS 2013, Ahmad-Reza Sadeghi, Virgil D. Gligor, and Moti Yung (Eds.). ACM Press, Berlin, Germany, 85–96. https://doi.org/10.1145/2508859. 2516719

    2013 doi

  29. [37]

    Simon Josefsson and Ilari Liusvaara. 2017. Edwards-Curve Digital Signature Algorithm (EdDSA). RFC 8032. https://doi.org/10.17487/RFC8032

    2017 doi

  30. [38]

    Ioannis Koniaris, Georgios Papadimitriou, and Petros Nicopolitidis. 2013. Analysis and visualization of SSH attacks using honeypots. In Eurocon 2013. 65–72. https: //doi.org/10.1109/EUROCON.2013.6624967

    2013

  31. [39]

    Hendrik W Lenstra Jr. 1987. Factoring integers with elliptic curves. Annals of mathematics (1987), 649–673

    1987

  32. [40]

    Lonvick and Sami Lehtinen

    Chris M. Lonvick and Sami Lehtinen. 2006. The Secure Shell (SSH) Protocol Assigned Numbers. RFC 4250. https://doi.org/10.17487/RFC4250

    2006 doi

  33. [41]

    Lonvick and Tatu Ylonen

    Chris M. Lonvick and Tatu Ylonen. 2006. The Secure Shell (SSH) Authentication Protocol. RFC 4252. https://doi.org/10.17487/RFC4252

    2006 doi

  34. [42]

    Lonvick and Tatu Ylonen

    Chris M. Lonvick and Tatu Ylonen. 2006. The Secure Shell (SSH) Connection Protocol. RFC 4254. https://doi.org/10.17487/RFC4254

    2006 doi

  35. [43]

    Lonvick and Tatu Ylonen

    Chris M. Lonvick and Tatu Ylonen. 2006. The Secure Shell (SSH) Protocol Archi- tecture. RFC 4251. https://doi.org/10.17487/RFC4251

    2006 doi

  36. [44]

    Lonvick and Tatu Ylonen

    Chris M. Lonvick and Tatu Ylonen. 2006. The Secure Shell (SSH) Transport Layer Protocol. RFC 4253. https://doi.org/10.17487/RFC4253

    2006 doi

  37. [45]

    Solomon Z Melese and PS Avadhani. 2016. Honeypot system for attacks on SSH protocol. International Journal of Computer Network and Information Security 8, 9 (2016), 19

    2016

  38. [46]

    Damien Miller. 2024. SSH Agent Protocol . Internet-Draft draft-ietf-sshm-ssh- agent-01. Internet Engineering Task Force. https://datatracker.ietf.org/doc/draft- ietf-sshm-ssh-agent/01/ Work in Progress

    2024

  39. [47]

    Damien Miller and Markus Friedl. 2020. This document describes OpenSSH’s support for U2F/FIDO security keys. https://cvsweb.openbsd.org/cgi-bin/cvsweb/ src/usr.bin/ssh/PROTOCOL.u2f?rev=1.26 accessed: 2025-04-14

    2020

  40. [48]

    Matus Nemec, Marek Sys, Petr Svenda, Dusan Klinec, and Vashek Matyas. 2017. The Return of Coppersmith’s Attack: Practical Factorization of Widely Used RSA Moduli. In ACM CCS 2017, Bhavani M. Thuraisingham, David Evans, Tal Malkin, and Dongyan Xu (Eds.). ACM Press, Dallas, TX, ...

    2017

  41. [49]

    National Institute of Standards and Technology. 2013. Digital Signature Standard (DSS). Technical Report Federal Information Processing Standards Publications (FIPS PUBS) 186-4. U.S. Department of Commerce, Washington, D.C. https: //doi.org/10.6028/NIST.FIPS.186-4

    2013 doi

  42. [50]

    National Institute of Standards and Technology. 2023. Digital Signature Standard (DSS). Technical Report Federal Information Processing Standards Publications (FIPS PUBS) 186-5. U.S. Department of Commerce, Washington, D.C. https: //doi.org/10.6028/NIST.FIPS.186-5

    2023 doi

  43. [51]

    Jim Owens and Jeanna Matthews. 2008. A study of passwords and methods used in brute-force SSH attacks. In USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET). 8

    2008

  44. [52]

    Jeonghoon Park, Jinsu Kim, Brij B Gupta, and Namje Park. 2021. Network log- based SSH brute-force attack detection model. Computers, Materials & Continua 68, 1 (2021)

    2021

  45. [53]

    Paterson and Gaven J

    Kenneth G. Paterson and Gaven J. Watson. 2010. Plaintext-Dependent Decryption: A Formal Security Treatment of SSH-CTR. In EUROCRYPT 2010 (LNCS, Vol. 6110), Henri Gilbert (Ed.). Springer Berlin Heidelberg, Germany, French Riviera, 345–

    2010

  46. [54]

    Julien Piet, Aashish Sharma, Vern Paxson, and David A. Wagner. 2023. Net- work Detection of Interactive SSH Impostors Using Deep Learning. In USENIX Security 2023, Joseph A. Calandrino and Carmela Troncoso (Eds.). USENIX As- sociation, Anaheim, CA, USA, 4283–4300. https://www....

    2023

  47. [55]

    Damian Poddebniak, Juraj Somorovsky, Sebastian Schinzel, Manfred Lochter, and Paul Rösler. 2018. Attacking Deterministic Signature Schemes Using Fault Attacks. In 2018 IEEE European Symposium on Security and Privacy. IEEE Computer Society Press, London, United Kingdom, 338–352...

    2018 doi

  48. [56]

    John M Pollard. 1978. Monte Carlo methods for index computation (mod p). Mathematics of computation 32, 143 (1978), 918–924

    1978

  49. [57]

    Thomas Pornin. 2013. Deterministic Usage of the Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA). RFC 6979. https: //doi.org/10.17487/RFC6979

    2013 doi

  50. [58]

    Niels Provos and Peter Honeyman. 2001. ScanSSH: Scanning the Internet for SSH Servers. In 15th Systems Administration Conference (LISA 2001) . USENIX As- sociation, San Diego, CA. https://www.usenix.org/conference/lisa-2001/scanssh- scanning-internet-ssh-servers

    2001

  51. [59]

    Keegan Ryan, Kaiwen He, George Arnold Sullivan, and Nadia Heninger. 2023. Passive SSH Key Compromise via Lattices. In ACM CCS 2023 , Weizhi Meng, Christian Damsgaard Jensen, Cas Cremers, and Engin Kirda (Eds.). ACM Press, Copenhagen, Denmark, 2886–2900. https://doi.org/10.1145...

    2023

  52. [60]

    Wagner, and Xuqing Tian

    Dawn Xiaodong Song, David A. Wagner, and Xuqing Tian. 2001. Timing Analysis of Keystrokes and Timing Attacks on SSH. In USENIX Security 2001 , Dan S. Wallach (Ed.). USENIX Association, Washington, DC, USA. http://www.usenix. org/publications/library/proceedings/sec01/song.html

    2001

  53. [61]

    The CADO-NFS Development Team. 2017. CADO-NFS, An Implementation of the Number Field Sieve Algorithm. http://cado-nfs.inria.fr/ Release 2.3.0, accessed: 2025-04-14

    2017

  54. [62]

    Filippo Valsorda. 2015. ssh who am i. https://words.filippo.io/ssh-whoami- filippo-io/ accessed: 2025-04-14

    2015

  55. [63]

    Kalbarczyk, and Ravishankar Krishnan Iyer

    Yuming Wu, Phuong M Cao, Alexander Withers, Zbigniew T. Kalbarczyk, and Ravishankar Krishnan Iyer. 2020. Mining Threat Intelligence from Billion-scale SSH Brute-Force Attacks. Proceedings 2020 Workshop on Decentralized IoT Systems and Security (2020)

    2020

  56. [64]

    Endadul Hoque, and Omar Chowdhury

    Moosa Yahyazadeh, Sze Yiu Chau, Li Li, Man Hong Hue, Joyanta Debnath, She- ung Chiu Ip, Chun Ngai Li, Md. Endadul Hoque, and Omar Chowdhury. 2021. Morpheus: Bringing The (PKCS) One To Meet the Oracle. In ACM CCS 2021 , Giovanni Vigna and Elaine Shi (Eds.). ACM Press, Virtual E...

    2021

  57. [65]

    Scott Yilek, Eric Rescorla, Hovav Shacham, Brandon Enright, and Stefan Savage

  58. [166]

    https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-0166 accessed: 2025-07-23

    2008

  59. [361]

    https://doi.org/10.1007/978-3-642-13190-5_18

    doi

  60. [2009]

    In Proceedings of the 9th ACM SIGCOMM Conference on Internet Measurement (Chicago, Illinois, USA) (IMC ’09)

    When private keys are public: results from the 2008 Debian OpenSSL vulnerability. In Proceedings of the 9th ACM SIGCOMM Conference on Internet Measurement (Chicago, Illinois, USA) (IMC ’09). Association for Computing Ma- chinery, New York, NY, USA, 15–27. https://doi.org/10.11...

    2008

  61. [8308]

    https://doi.org/10.17487/RFC8308

    doi

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.