Warning: The remote host key has changed.

[blaklinten]

I use a private Github repository as my remote password store and it has worked flawlessly the past year.

Recently, however, I get an error when I try to update from my remote:

An error occurred during a Git operation
WARNING: The remote host key has changed, If this is expected, please go to Git server settings and clear the saved host key

I added a new password, successfully, only two days ago, so this error is somewhat recent.
The app has not been updated since the last successful password addition.
I also utilize the same Git-repository for my pass instance running on my Raspberry Pi and from there I have no issue updating from the remote (I also find it quite unlikely that Github has changed its public ssh-key, as this is what I understand the error to be about).

As I understand, there are two possible explanations for this error;

• The app (or me, unknowingly) has somehow destroyed the saved host key and just clearing the key should resolve this issue.
• I have been hacked and someone is performing a MITM attack to try and get all my passwords.

Do someone here have any ideas on how I could either investigate further or solve this issue in a safe and secure manner? Can I somehow make sure that no one is trying to hack me?

[msfjarvis]

GitHub recently (16th November 2021) got rid of their DSA SSH key and now only support RSA, ECDSA, and ED25519. It's possible that APS was using DSA before it was sunset and is now negotiating a different, more secure algorithm.

[blaklinten]

That makes sense, thank you @msfjarvis for that information!

Is there any way to confirm what key APS is using when the warning is triggered? I have looked in the settings of the app but from what I understand I can only list my public key and not see the remote host key...

[msfjarvis]

We print the pinned host key to device logs. In the app, go to settings > misc and turn on debug logging. Then restart the app, try to connect again and there should be a line starting with Pinned host key when you inspect the logcat output.

[blaklinten]

Ok, great. I just checked this and it seems as if your guess was correct; APS tries to verify one of Githubs new keys (the ed25519 one) with an incorrect (too old?) algorithm. I have also made sure that the fingerprint of the offered key matches the one presented at Github

I am now confident that just clearing the saved host key will fix my issue, thank you so much for your help!