Hacker News Reader

> If you are using our ECDSA or Ed25519 keys, you will not notice any change and no action is needed.

How is this true? AFAIK, A MITM with the github priv key will be able to do an SSH downgrade attack...

The SSH client verifies that the host key sent by the server matches the one stored in ~/.ssh/known_hosts. If the key material or algorithm is different, the client refuses to connect. So the server can't force the client to switch from ECDSA / Ed25519 to RSA.

Edit: The above is true if known_hosts contains only the ECDSA / Ed25519 host key. But as mentioned elsewhere in this thread, newer OpenSSH versions automatically add alternate host keys (https://lwn.net/Articles/637156/), in which case the old RSA key would have been added to known_hosts even if only ECDSA / Ed25519 were used. In that case, the user will be vunlerable until the next time they ssh into (non-MITM) github.com, since that will update the RSA key in known_hosts.

Reply on news.ycombinator.com