TechPrufer
Get started
GitHub
GitHub logoGitHub · Feature trail

Post-quantum SSH security for Git access

5 posts · Feb 2017 – Sep 2025

What this trail covers

This feature thread tracks the evolution of securing Git access over SSH, specifically focusing on adopting post-quantum cryptography and enhancing security key integration to protect against future decryption attacks and unauthorized access. Initially, the focus was on current SSH security standards and the introduction of security keys for Git operations. This post details the deprecation and eventual disablement of TLSv1/TLS1.1 for HTTPS connections and diffie-hellman-group1-sha1/diffie-hellman-group14-sha1 key exchange algorithms, and the introduction of a hybrid post-quantum key exchange algorithm (`sntrup761x25519-sha512`) for SSH connections to protect against future quantum computing threats.

All GitHub trails
  1. Post-quantum security for SSH access on GitHubThis post details the introduction of a hybrid post-quantum key exchange algorithm (`sntrup761x25519-sha512`) for SSH connections to GitHub. It explains the 'store now, decrypt later' threat posed by quantum computers and how combining a new post-quantum algorithm with a classical one provides security against such attacks. It also outlines the rollout plan and provides instructions for users to check their SSH client's support for the new algorithm.
  2. Security keys are now supported for SSH Git operationsThis post details the implementation of security key support for Git operations over SSH, introducing new key types (`ecdsa-sk`, `ed25519-sk`) that bind SSH keys to physical security devices. It emphasizes the security benefits of moving sensitive key material off the local machine, protecting against malware and accidental exposure. The post also highlights the requirement for user presence verification (a tap on the security key) for remote Git operations to prevent unauthorized actions, and discusses the ongoing shift away from password-based authentication for Git operations.
  3. Commit signing support for bots and other GitHub AppsThis post introduces the enablement of commit signing for bots and GitHub Apps by default. It explains what commit signing is and its benefits for verifying the integrity and authorship of commits. The post highlights that this feature is now enabled for all bots, ensuring that automated contributions can also be cryptographically verified.
  4. SSH certificate authentication for GitHub Enterprise CloudThis post introduces SSH certificate authentication for GitHub Enterprise Cloud. It explains how organizations can upload an SSH Certificate Authority (CA) public key and issue signed certificates to their members. These certificates can be used for Git authentication to access organization repositories, offering granular control over access with features like daily expirations. The post details the process of generating and signing certificates, highlighting the benefits for security-conscious teams.
  5. Discontinue support for weak cryptographic standardsThis post announces the deprecation and eventual disablement of TLSv1/TLSv1.1 for HTTPS connections and diffie-hellman-group1-sha1/diffie-hellman-group14-sha1 for SSH connections. It provides technical details on the vulnerabilities of these older standards (POODLE, Logjam) and the rationale for upgrading to TLS 1.2 and diffie-hellman-group-exchange-sha256. The post outlines a timeline for disablement (February 1, 2018) and the steps being taken to minimize user impact, including internal updates to SSH implementations and communication to affected users.