News for hackers. Stuff that matters.

A comment on PuTTY vulnerability vuln-p521-bias. Parent comment

Re:PuTTY vulnerability vuln-p521-bias by ajb on Tuesday April 16, 2024 @03:38AM (#40049329)
It says in the OP. Windows at the time did not provide a cryptographic quality random number source.
[ Parent | on HN ]
Re:PuTTY vulnerability vuln-p521-bias by denton-scratch on Tuesday April 16, 2024 @05:31AM (#40050004)
I saw that, and wondered why PuTTY didn't contain it's own good CSPRNG, something like Fortuna, if Windows didn't offer one.
[ Parent | on HN ]
Re:PuTTY vulnerability vuln-p521-bias by ajb on Tuesday April 16, 2024 @05:42AM (#40050074)
You still need a source of entropy, which is easier for an OS. An app has to resort to the user moving the mouse or bashing keys, which is a worse UX, although I guess they did that for actual key generation (if PuTTY did that) but it would be annoying to do it every time you made a connection.
[ Parent | on HN ]