Security News > 2021 > October > GitHub revokes duplicate SSH auth keys linked to library bug
GitHub has revoked weak SSH authentication keys generated using a library that incorrectly created duplicate RSA keypairs.
Today, in a coordinated disclosure between GitHub and Axosoft, LLC., the makers of the popular GitKraken Git client, GitHub said they revoked weak SSH keys generated by the 'keypair' library used by the software.
Keypair is a JavaScript library that allows for the programmatic generation of SSH keys.
A bug in the library's pseudo-random number generator allowed for the generation of duplicate RSA keys, enabling users to access other GitHub accounts secured with the same SSH key.
To protect their users, GitHub revoked all keys generated by GitKraken at 17:00 UTC or 1 PM EST. GitHub also revoked other potentially weak keys that were created by other clients using the same keypair library.
Users whose keys have been revoked are notified by GitHub and recommended to review their SSH keys and replace them if the vulnerable library generated them.