Fabian Bäumer from RUB disclosed the details for a secret key recovery of NIST P-521 private keys (CVE-2024-31497) in oss-security. Marcus Brinkmann announced it on Twitter. In his thread he explains that the top 9 bits of every P-521 nonce are always zero, so at least 521/9 ≈ 58 signatures from signed Git commits or logins to an attacker’s SSH server are enough to compute the private key offline. Fixed in PuTTY 0.81.
