CVE-2021-41117
📋 TL;DR
The keypair library generates identical RSA keys due to flawed random number generation, particularly in Node.js environments. This allows attackers to guess private keys, potentially decrypting encrypted communications or gaining unauthorized access to systems using these keys. Anyone using the keypair library to generate RSA keys for SSH, TLS, or other cryptographic purposes is affected.
💻 Affected Systems
- keypair library
📦 What is this software?
Keypair by Keypair Project
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of encrypted communications, unauthorized access to all systems using affected keys, and impersonation of legitimate users or services.
Likely Case
Attackers can generate duplicate private keys to access SSH servers, decrypt TLS sessions, or forge digital signatures where vulnerable keys are used.
If Mitigated
If keys are regenerated with proper CSPRNG and old keys are revoked, impact is limited to potential historical data exposure.
🎯 Exploit Status
The vulnerability allows deterministic key generation, making exploitation straightforward. Public proof-of-concept demonstrates generating duplicate keys.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.4
Vendor Advisory: https://github.com/juliangruber/keypair/security/advisories/GHSA-3f99-hvg4-qjwj
Restart Required: No
Instructions:
1. Update keypair to version 1.0.4 or later using npm: npm update keypair. 2. Regenerate all RSA keys created with vulnerable versions. 3. Replace old keys in all systems (SSH, TLS certificates, etc.).
🔧 Temporary Workarounds
Use alternative key generation
allReplace keypair with secure alternatives like Node.js crypto module or OpenSSL for key generation.
npm uninstall keypair
npm install openssl-wrapper (or use native crypto)
🧯 If You Can't Patch
- Immediately regenerate all RSA keys using a secure CSPRNG (e.g., Node.js crypto.randomBytes or OpenSSL) and replace them in all systems.
- Monitor for unauthorized access attempts on systems using potentially vulnerable keys and implement additional authentication layers.
🔍 How to Verify
Check if Vulnerable:
Check package.json for keypair version <1.0.4 or run: npm list keypair | grep keypairCheck Version:
npm list keypair | grep keypairVerify Fix Applied:
Confirm keypair version is 1.0.4 or higher: npm list keypair. Verify new keys are generated using secure methods.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts with different keys, unusual SSH or TLS connection patterns
Network Indicators:
- Suspicious traffic patterns suggesting key compromise, unexpected successful authentications
SIEM Query:
Search for authentication events from unexpected sources or repeated failed attempts followed by success.