On the Security of SSH Client Signatures

• URL: http://arxiv.org/abs/2509.09331v1
• Date: Thu, 11 Sep 2025 10:32:13 GMT
• Title: On the Security of SSH Client Signatures
• Abstract summary: Unlike servers, SSH clients cannot be measured through internet scans.<n>We collect SSH client public keys regularly published by their owners on open development platforms like GitHub and GitLab.<n>We analyze the implementations of algorithms for SSH client signatures in 24 popular SSH clients for Linux, Windows, and Windows.
• Score: 11.441003526397209
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Administrators and developers use SSH client keys and signatures for authentication, for example, to access internet backbone servers or to commit new code on platforms like GitHub. However, unlike servers, SSH clients cannot be measured through internet scans. We close this gap in two steps. First, we collect SSH client public keys. Such keys are regularly published by their owners on open development platforms like GitHub and GitLab. We systematize previous non-academic work by subjecting these keys to various security tests in a longitudinal study. Second, in a series of black-box lab experiments, we analyze the implementations of algorithms for SSH client signatures in 24 popular SSH clients for Linux, Windows, and macOS. We extracted 31,622,338 keys from three public sources in two scans. Compared to previous work, we see a clear tendency to abandon RSA signatures in favor of EdDSA signatures. Still, in January 2025, we found 98 broken short keys, 139 keys generated from weak randomness, and 149 keys with common or small factors-the large majority of the retrieved keys exposed no weakness. Weak randomness can not only compromise a secret key through its public key, but also through signatures. It is well-known that a bias in random nonces in ECDSA can reveal the secret key through public signatures. For the first time, we show that the use of deterministic nonces in ECDSA can also be dangerous: The private signing key of a PuTTY client can be recovered from just 58 valid signatures if ECDSA with NIST curve P-521 is used. PuTTY acknowledged our finding in CVE-2024-31497, and they subsequently replaced the nonce generation algorithm.

Related papers

• Hardware Keystores for AI Agent Signing Workflows: A Zero-Trust MCP Enforcement Architecture [0.0]
  Hardware-confined keys are accessible through a vendor-neutral PKCS interface.<n> Hardware confinement is the primary contribution.<n>We evaluate against 12 injection scenarios derived from AgentDojo's ImportantAttack template.
  arXiv  Detail & Related papers  (2026-08-06T15:04:26Z)
• CryptanalysisBench: Can LLMs do Cryptanalysis? [76.79639292270497]
  We introduce CryptanalysisBench, 191 tasks across six families of cryptographic primitives.<n>Our benchmark consists of three tiers: (i) primitives with known practical breaks; (ii) primitives with no known practical break, evaluated both at full strength and as scaled-down variants.<n>Five frontier models break 65%-86% of Tier 1 schemes, 6-12 Tier-2 schemes at full strength, and 24-61 across all scaled-down variants.
  arXiv  Detail & Related papers  (2026-07-20T22:09:40Z)
• Finding SSH Strict Key Exchange Violations by State Learning [9.954798022417135]
  SSH is an important protocol for secure remote shell access to servers on the Internet.<n>At USENIX 2024, B"aumer et al. presented the Terrapin attack on SSH, which relies on the attacker injecting optional messages during the key exchange.<n>To mitigate this attack, SSH vendors adopted an extension developed by OpenSSH called strict key exchange ("strict KEX").<n>With strict KEX, optional messages are forbidden during the handshake, preventing the attack.
  arXiv  Detail & Related papers  (2025-09-13T16:54:10Z)
• SSH-Passkeys: Leveraging Web Authentication for Passwordless SSH [11.865671333047658]
  Passwords remain the dominant mode of SSH authentication, despite their well known flaws such as phishing and reuse.<n>WebAuthn is a modern authentication standard designed to replace passwords, managing keys on behalf of the user.<n>We propose a framework to integrate WebAuthn with SSH servers, by using UNIX pluggable authentication modules (PAM)
  arXiv  Detail & Related papers  (2025-07-11T21:13:09Z)
• Decompiling Smart Contracts with a Large Language Model [51.49197239479266]
  Despite Etherscan's 78,047,845 smart contracts deployed on (as of May 26, 2025), a mere 767,520 ( 1%) are open source.<n>This opacity necessitates the automated semantic analysis of on-chain smart contract bytecode.<n>We introduce a pioneering decompilation pipeline that transforms bytecode into human-readable and semantically faithful Solidity code.
  arXiv  Detail & Related papers  (2025-06-24T13:42:59Z)
• Quantum digital signature based on single-qubit without a trusted third-party [45.41082277680607]
  We propose a novel quantum digital signature protocol without a trusted third-party.<n>We prove that the protocol has information-theoretical unforgeability.
  arXiv  Detail & Related papers  (2024-10-17T09:49:29Z)
• A Simple Framework for Secure Key Leasing [10.04587045407742]
  Key-revocable cryptography enables us to lease a cryptographic key as a quantum state in such a way that the key can be later revoked in a verifiable manner.<n>We propose a simple framework for constructing cryptographic primitives with secure key leasing via the certified deletion property of BB84 states.
  arXiv  Detail & Related papers  (2024-10-04T13:24:03Z)
• Revocable Quantum Digital Signatures [57.25067425963082]
  We define and construct digital signatures with revocable signing keys from the LWE assumption. In this primitive, the signing key is a quantum state which enables a user to sign many messages. Once the key is successfully revoked, we require that the initial recipient of the key loses the ability to sign.
  arXiv  Detail & Related papers  (2023-12-21T04:10:07Z)
• Terrapin Attack: Breaking SSH Channel Integrity By Sequence Number Manipulation [11.499428847222099]
  We show that the SSH Binary Packet Protocol is no longer a secure channel. This allows prefix truncation attacks where encrypted packets at the beginning of the SSH channel can be deleted without the client or server noticing it. We propose effective and backward-compatible changes to SSH to mitigate our attacks.
  arXiv  Detail & Related papers  (2023-12-19T18:51:12Z)
• Scalable Multi-domain Trust Infrastructures for Segmented Networks [1.388092651233226]
  This paper outlines a method of creating a leaderless approach to defining trust domains. It proposes the usage of the Edwards curve digital signature algorithm for the definition of multiple trust zones.
  arXiv  Detail & Related papers  (2023-10-07T19:24:09Z)
• Revocable Cryptography from Learning with Errors [61.470151825577034]
  We build on the no-cloning principle of quantum mechanics and design cryptographic schemes with key-revocation capabilities. We consider schemes where secret keys are represented as quantum states with the guarantee that, once the secret key is successfully revoked from a user, they no longer have the ability to perform the same functionality as before.
  arXiv  Detail & Related papers  (2023-02-28T18:58:11Z)
• First demonstration of a post-quantum key-exchange with a nanosatellite [58.579141089302816]
  We demonstrate a post-quantum key-exchange with the nanosatellite SpooQy-1 in low Earth orbit using Kyber-512. This implementation demonstrates the feasibility of a quantum-safe authenticated key-exchange and encryption system on SWaP constrained nanosatellites.
  arXiv  Detail & Related papers  (2022-06-02T10:45:27Z)
• Recovering AES Keys with a Deep Cold Boot Attack [91.22679787578438]
  Cold boot attacks inspect the corrupted random access memory soon after the power has been shut down. In this work, we combine a novel cryptographic variant of a deep error correcting code technique with a modified SAT solver scheme to apply the attack on AES keys. Our results show that our methods outperform the state of the art attack methods by a very large margin.
  arXiv  Detail & Related papers  (2021-06-09T07:57:01Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.