@lispi314 @indigoparadox PuTTY on any platform, actually. PuTTY can run on Unix too, though it's less popular there. And its ECDSA signing code is the same wherever it's running.

Independent implementations such as OpenSSH aren't affected, that's correct.

@agitatra @lispi314 @indigoparadox interesting thought – hadn't occurred to me!

Off the top of my head I'd guess the number of P521 users is _relatively_ small. As another commenter pointed out, it's never been PuTTY's default; and generally the NIST curves seem to have mostly gone out of fashion these days, in favour of Ed25519.

So I doubt this was _all_ the xz backdoor actors were after. It doesn't seem worth all the effort by itself. But it could have been one thing on their shopping list.