I am wondering how PuTTY stacks up against other SSH implementations with respect to scrutiny and security of its SSH2 protocol implementation.

PuTTY is probably the most-used SSH client on the Windows platform, so its importance cannot be understated.

I am aware that there have been several very crafty attacks in past years against SSL/TLS implementations (and, also, against the protocols themselves, but that is another issue).

In that light, I wonder if anyone has done work to validate/break SSH clients on the Windows platform and whether PuTTY fares well.

  • 6
    Resisting the need to point out that if you're using Windows then security must not be one of your core concerns. Must...not..state...the...obvious.. – tylerl Feb 19 '15 at 8:15

Putty being open-source, there have been a number of informal security audits, some resulting in vulnerability reports and patches.

There may have also been some formal security audits commissioned by users of the product. Some searching revealed a bit of unverifiable evidence of such, but most importantly:

Simon doesn't advertise or reference any official audit of his code. Any audits done were done by a private party, for a private party, and may not have been scoped in such a way as to be applicable to your circumstances.

Note that form what I've seen the official source for PuTTY is http://www.chiark.greenend.org.uk/~sgtatham/putty/ by the author and maintainer Simon Tatham.

Sadly this page is not available over TLS and the GPG signatures for the binaries link to an external page, so there is a serious risk of somebody tampering with your connection when you download putty potentially inserting malicious code or even redirecting to a different page for the signatures.

I've wanted to vent about this situation for a long time when I stumbled upon this question, a high-profile security critical software like PuTTY really shouldn't be distributed over plain HTTP.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.