GitHub Revoked Insecure SSH Keys Generated by a Popular git Client

Code hosting platform GitHub has revoked^[1]
weak SSH authentication keys that were generated via the GitKraken
git GUI client due to a vulnerability in a third-party library that
increased the likelihood of duplicated SSH keys.

As an added precautionary measure, the Microsoft-owned company
also said it’s building safeguards to prevent vulnerable versions
of GitKraken from adding newly generated weak keys.

The problematic dependency, called “keypair^[2],” is an open-source SSH
key generation library that allows users to create RSA keys for
authentication-related purposes. It has been found to impact
GitKraken^[3]
versions 7.6.x, 7.7.x, and 8.0.0, released between May 12, 2021,
and September 27, 2021.

But due to a bug in the pseudo-random number generator used by
the library, the flaw resulted in the creation of a weaker form of
public SSH keys, which, owing to their low entropy — i.e., the
measure of randomness — could boost the probability of key
duplication.

“This could enable an attacker to decrypt confidential messages
or gain unauthorized access to an account belonging to the victim,”
keypair’s maintainer Julian Gruber said^[4]
in an advisory published Monday. The issue has since been addressed
in keypair version 1.0.4 and GitKraken version 8.0.1.

Axosoft engineer Dan Suceava has been credited with discovering
the security weakness, while GitHub security engineer Kevin Jones
has been acknowledged for identifying the cause and source code
location of the bug. As of writing, there’s no evidence the flaw
was exploited in the wild to compromise accounts.

Affected users are highly recommended to review and “remove all
old GitKraken-generated SSH keys stored locally” and “generate new
SSH keys using GitKraken 8.0.1, or later, for each of your Git
service providers” such as GitHub, GitLab, and Bitbucket, among
others.