[e79]

I did a bit of a deep dive into this, in case anyone is interested. I think reading the code is a great way to understand _why_ this vulnerability happened:

https://ericrafaloff.com/your-putty-generated-nist-p-521-key...

[Elucalidavah]

Your title says "PuTTY-Generated" but the OP article says "The problem is not with how the key was originally generated; it doesn't matter whether it came from PuTTYgen or somewhere else. What matters is whether it was ever used with PuTTY or Pageant".

[e79]

Good catch! I wrote the title before I had dug into the matter and forgot to update it. Thanks for pointing that out.

Any k generation and subsequent signature generation are going to be impacted.

[Aachen]

The answer being, per that post: author was worried about low quality randomness on Windows and ran it through a sha512 hash function which outputs fewer than 521 bits so the remaining ones will be left zero

[e79]

Updated link with corrected title: https://ericrafaloff.com/biased-nonce-generation-in-putty-fo...

[ki85squared]

Thank you. Your writeup helped make it click!