Elektrine
EN
Log in Register
Paige Chat Timeline Communities Gallery Videos Email DNS VPN Uptime Kairo
Back to Timeline
Remote

lambdafu

@lambdafu@mastodon.social
mastodon 4.7.0-beta.1
  • Open on mastodon.social

I'm a tempura shrimp and you can't catch me! | 🦙 ALPACA Attack | 🦝 Raccon Attack | 😈 DEMONS Attack | @lambdafu@mastodon.social on Twitter.

236 Followers
88 Following
14 Posts
Joined May 20, 2017

Posts

Open post
lambdafu
lambdafu @lambdafu@mastodon.social · Feb 11, 2026
lambdafu
@lambdafu@mastodon.social

I'm a tempura shrimp and you can't catch me! | 🦙 ALPACA Attack | 🦝 Raccon Attack | 😈 DEMONS Attack | @lambdafu on Twitter.

mastodon.social

The 2nd SPIQE Workshop on Secure Protocol Implementations in the Quantum Era is this year associated with EuroS&P in Lisbon, Portugal! Come to Lisbon in July and present your academic or industry talk on meeting the challenges in actually bringing PQC into the real world safely! Submission deadline is March, 13, see our call for papers for details!
https://spiqe.cool #PQC #EuroSP #crypto

0
0
0
0
Open post
lambdafu
lambdafu @lambdafu@mastodon.social · Apr 15, 2024
lambdafu
@lambdafu@mastodon.social

I'm a tempura shrimp and you can't catch me! | 🦙 ALPACA Attack | 🦝 Raccon Attack | 😈 DEMONS Attack | @lambdafu on Twitter.

mastodon.social
Replying to @lambdafu@mastodon.social
PuTTY 0.81 has been fixed to use a more secure nonce generation (RFC6979 by Thomas Pornin). Filezilla Client 3.67.0 also includes a fixed version of PuTTY. Git Tortoise and WinSCP also ship with a bundled PuTTY, but no update is available yet. 🤞
1
0
1
0
Open post
lambdafu
lambdafu @lambdafu@mastodon.social · Apr 15, 2024
lambdafu
@lambdafu@mastodon.social

I'm a tempura shrimp and you can't catch me! | 🦙 ALPACA Attack | 🦝 Raccon Attack | 😈 DEMONS Attack | @lambdafu on Twitter.

mastodon.social
Replying to @lambdafu@mastodon.social
Using recent versions of the attack by Albrecht/Heninger, we can calculate the private key from 58 PuTTY P-521 signatures with a 50% probability (59 sigs: 94% success, 60 sigs: 100% success). https://eprint.iacr.org/2020/1540 Shout out to Julian Nowakowski for helping us understand the math!
3
1
0
0
Open post
lambdafu
lambdafu @lambdafu@mastodon.social · Apr 15, 2024
lambdafu
@lambdafu@mastodon.social

I'm a tempura shrimp and you can't catch me! | 🦙 ALPACA Attack | 🦝 Raccon Attack | 😈 DEMONS Attack | @lambdafu on Twitter.

mastodon.social
Replying to @lambdafu@mastodon.social
The attack on ECDSA with biased nonces is a standard technique. An attacker collects at least 521/9≈58 signatures from signed Git commits or victim logins into the attacker's SSH server. A bit of math allows the attacker to calculate the private key offline.
1
1
0
0
Open post
lambdafu
lambdafu @lambdafu@mastodon.social · Apr 15, 2024
lambdafu
@lambdafu@mastodon.social

I'm a tempura shrimp and you can't catch me! | 🦙 ALPACA Attack | 🦝 Raccon Attack | 😈 DEMONS Attack | @lambdafu on Twitter.

mastodon.social
Replying to @lambdafu@mastodon.social
For DSA (160 bit) and ECDSA P-256/P-384, the modulo is so small that a 512 bit number wraps around often, and the output looks pseudo-random. Not so for P-521! Here the modulo is a no-op, and the high 9 bits of the nonce are always zero! This is enough to allow an attack!
1
1
0
0
Open post
lambdafu
lambdafu @lambdafu@mastodon.social · Apr 15, 2024
lambdafu
@lambdafu@mastodon.social

I'm a tempura shrimp and you can't catch me! | 🦙 ALPACA Attack | 🦝 Raccon Attack | 😈 DEMONS Attack | @lambdafu on Twitter.

mastodon.social
Replying to @lambdafu@mastodon.social
Many programs use random nonces 🎲, but some, including PuTTY, generate them deterministically 🧮from the private key and the message to be signed. PuTTY uses SHA-512(ID || SHA-512(x) || SHA1(m)) modulo group size as a pseudo-random nonce. Can you see a problem? 🤔
1
1
0
0
Open post
lambdafu
lambdafu @lambdafu@mastodon.social · Apr 15, 2024
lambdafu
@lambdafu@mastodon.social

I'm a tempura shrimp and you can't catch me! | 🦙 ALPACA Attack | 🦝 Raccon Attack | 😈 DEMONS Attack | @lambdafu on Twitter.

mastodon.social
Replying to @lambdafu@mastodon.social
Each (EC)DSA signature needs a secret number only used once ("nonce"). If the nonce is revealed, reused, or in biased (not fully random), an attacker can use the signatures to recover the private key, which is bad. So, randomness and secrecy of nonces is super important.
1
1
0
0
Open post
lambdafu
lambdafu @lambdafu@mastodon.social · Apr 15, 2024
lambdafu
@lambdafu@mastodon.social

I'm a tempura shrimp and you can't catch me! | 🦙 ALPACA Attack | 🦝 Raccon Attack | 😈 DEMONS Attack | @lambdafu on Twitter.

mastodon.social

We found a critical vulnerability in #PuTTY SSH client with NIST P-521 keys, that allows private key recovery from only 60 signatures, CVE-2024-31497! If you use #Putty or #Filezilla with ECDSA P-521, upgrade now and generate a new key! Joint work with @Skrillor@infosec.exchange!

9
6
10
0
Open post
lambdafu
lambdafu @lambdafu@mastodon.social · Dec 19, 2023
lambdafu
@lambdafu@mastodon.social

I'm a tempura shrimp and you can't catch me! | 🦙 ALPACA Attack | 🦝 Raccon Attack | 😈 DEMONS Attack | @lambdafu on Twitter.

mastodon.social
Replying to @floris@freeradical.zone
@floris Thanks! It brings a bit of color into the world for sure. 🐢
2
0
0
0
Open post
lambdafu
lambdafu @lambdafu@mastodon.social · Dec 18, 2023
lambdafu
@lambdafu@mastodon.social

I'm a tempura shrimp and you can't catch me! | 🦙 ALPACA Attack | 🦝 Raccon Attack | 😈 DEMONS Attack | @lambdafu on Twitter.

mastodon.social
Replying to @hanno@mastodon.social
@hanno We added it to the FAQ, thanks for the suggestion!
0
0
0
0
Open post
lambdafu
lambdafu @lambdafu@mastodon.social · Dec 18, 2023
lambdafu
@lambdafu@mastodon.social

I'm a tempura shrimp and you can't catch me! | 🦙 ALPACA Attack | 🦝 Raccon Attack | 😈 DEMONS Attack | @lambdafu on Twitter.

mastodon.social
Replying to @hanno@mastodon.social
@hanno Yes, GCM derives the invocation counter only from the IV and a counter that starts at zero, ignoring the SSH standard. The RFC explains that because it is a constant offset from the actual sequence number, that should not be an issue. But in fact, this prevents the attack!
1
0
0
0
Open post
lambdafu
lambdafu @lambdafu@mastodon.social · Dec 18, 2023
lambdafu
@lambdafu@mastodon.social

I'm a tempura shrimp and you can't catch me! | 🦙 ALPACA Attack | 🦝 Raccon Attack | 😈 DEMONS Attack | @lambdafu on Twitter.

mastodon.social
Replying to @lambdafu@mastodon.social
In AsyncSSH v2.14.0 and earlier, the attacker can even control EXT_INFO, or log the victim into an attacker controlled shell. Affected are ChaCha20-Poly1305 and Encrypt-then-MAC modes like CBC-EtM and CTR-EtM. These are supported by 77% of SSH servers on the internet - 57% list one of them as their preferred choice. Fixing this requires changes to the specification. OpenSSH implements a new "strict kex" countermeasure that has been adopted by other vendors. Check your vendor for updates!
6
1
4
0
Open post
lambdafu
lambdafu @lambdafu@mastodon.social · Dec 18, 2023
lambdafu
@lambdafu@mastodon.social

I'm a tempura shrimp and you can't catch me! | 🦙 ALPACA Attack | 🦝 Raccon Attack | 😈 DEMONS Attack | @lambdafu on Twitter.

mastodon.social
Replying to @lambdafu@mastodon.social
Our attack exploits that SSH does not authenticate the entire handshake, but only parts of it, and that sequence numbers carry over to the encrypted channel. This allows an attacker to insert a message into the handshake while dropping one from the secure channel. Here is an example where the attacker uses IGNORE to drop EXT_INFO. This downgrades client authentication algorithms, and disables keystroke timing countermeasures in OpenSSH 9.5.
6
5
1
0
Open post
lambdafu
lambdafu @lambdafu@mastodon.social · Dec 18, 2023
lambdafu
@lambdafu@mastodon.social

I'm a tempura shrimp and you can't catch me! | 🦙 ALPACA Attack | 🦝 Raccon Attack | 😈 DEMONS Attack | @lambdafu on Twitter.

mastodon.social

We found a flaw in the SSH specification which allows a MitM attacker to drop certain messages from the secured connection. If you are using SSH, check this out: https://terrapin-attack.com 🐢

Joined work with Fabian Bäumer and Jörg Schwenk at Ruhr University Bochum, HGI, funded by CASA Excellence Cluster / DFG.

96
12
125
0

Remote instance

mastodon.social
Open on original server

Media

313k7r1n3
Elektrine

Tor hidden service

elekhj7afj4qnrr4yd3bkzslsyo5jgfxw3orgjkhlcxifueodybyiiad.onion

Platform

  • Email
  • Chat
  • Timeline
  • Communities
  • VPN
  • DNS

Company

  • About
  • Contact
  • FAQ

Legal

  • Terms of Service
  • Privacy Policy
  • Warrant Canary
  • Lite (no JS)
  • VPN Policy
  • Source code

Support

  • support@elektrine.com
  • Report Security Issue
Mail client setup IMAP mail.elektrine.com:993 POP3 mail.elektrine.com:995 SMTP mail.elektrine.com:465
© 2026 Elektrine. All rights reserved. Server: 23:11:25 UTC