Eclipse/Git: "You're using an RSA key with SHA-1, which is no longer allowed. Please use a newer client or a different key type."

Viewed 16662

I created a public key in Git using ssh-keygen which was successfully created as .ssh/id_rsa.pub.

enter image description here

I then uploaded it to GitHub in my SSH Keys, and "Authorized" its SSO feature. Everything is uploaded now.

enter image description here

When cloning a repository in Eclipse, I get the following message enter image description here

5 Answers

According to Github security blog RSA keys with SHA-1 are no longer accepted.

Use the following command to create new SSH key with ECDSAencryption and add it to Github.

ssh-keygen -t ecdsa -b 521 -C "your_email@example.com"

Original answer with details can be found here

I had to generate an ECDSA key, not an RSA key. Not sure why, but none of the RSA options worked for me, including the default.

ssh-keygen -t ecdsa -b 256 -m PEM

I got this from https://stackoverflow.com/a/71502531/1005607

Then I uploaded it to GitHub (after deleting my old key first), updated my Eclipse SSH2 private key to point to id_ecdsa. Now I can clone repositories.

you can follow this steps To solve this problem :

in your terminal type this command ssh-keygen -t ecdsa -b 521 -C "your_email@example.com" you will be ask:

-"enter file in which To save the key" click enter

-enter passphrase (empty for no passphrase) click enter again

  • enter same passphrase again click enter

you will a message "your public key vas been saved in /user/machine/.ssh/id_ecdsa.pub(just an example ).

-type cat (where the file was save in my case /user/machine/.ssh/id_ecdsa.pub) To see your new generate ecdsa key .copy and go to github create a new ssh (dont forget to remove the old one ) and paste it then save

in your terminal again type ssh-add (directory of your new created id_ecdsa) to add it to the list. you will see identity added : directory of your key

hope this was helpful

It's not about RSA key type, it about the weakness of sha1 signature. According to the man page of ssh-keygen (macOS 12.6), the -t flag section, newer version of ssh-keygen will use sha512 by default:

This flag may also be used to specify the desired signature type when signing certificates
using an RSA CA key. The available RSA signature variants are “ssh-rsa” (SHA1 signatures,
not recommended), “rsa-sha2-256”, and “rsa-sha2-512” (the default).

Override deprecated key type with -t flag might help:

ssh-keygen -t rsa-ssh2-512

Also, double check and make sure your Git client is actually using the right key file.

Small remark I had to first delete old key from my github account. I am not sure if it was just some coincidence.

Related