GitHub is introducing post-quantum secure key exchange methods for SSH access to better protect Git data in transit.
Overview
GitHub is adding post-quantum secure SSH key exchange using the sntrup761x25519-sha512 hybrid algorithm to protect Git data access against future quantum computer decryption attacks. The change combines Streamlined NTRU Prime with classical Elliptic Curve Diffie-Hellman (X25519) to ensure security isn't weaker than current standards while adding quantum resistance. The rollout targets September 17, 2025 for GitHub.com and non-US GitHub Enterprise Cloud regions.
What You'll Learn
1
Why post-quantum cryptography matters for SSH connections today
2
How the hybrid sntrup761x25519-sha512 key exchange algorithm combines classical and post-quantum security
3
How to check if your OpenSSH client supports post-quantum key exchange algorithms
4
What a 'store now, decrypt later' attack is and why it threatens current SSH sessions
5
When GitHub's post-quantum SSH changes take effect and which environments are affected
Prerequisites & Requirements
- Basic understanding of SSH and how it's used for Git remote access
- OpenSSH 9.0 or newer for automatic post-quantum key exchange support(optional)
- Familiarity with public key cryptography and key exchange concepts(optional)
Key Questions Answered
What post-quantum SSH algorithm is GitHub adding for Git access?
GitHub is adding the sntrup761x25519-sha512 hybrid key exchange algorithm (also known as [email protected]). It combines Streamlined NTRU Prime, a post-quantum-secure algorithm, with classical Elliptic Curve Diffie-Hellman using the X25519 curve. This hybrid approach ensures security is never weaker than what classical algorithms provide, even if the post-quantum component has undiscovered weaknesses.
What is a store now decrypt later attack in SSH?
A 'store now, decrypt later' attack occurs when an adversary captures and saves encrypted SSH session traffic today, then waits until a sufficiently powerful quantum computer exists to break the classical key exchange algorithms and decrypt the stored sessions. This means data transmitted over SSH today could be exposed in the future, which is why adopting post-quantum key exchange algorithms proactively is important.
When does GitHub enable post-quantum SSH key exchange?
GitHub will enable the new post-quantum SSH key exchange algorithm on September 17, 2025 for GitHub.com and GitHub Enterprise Cloud with data residency, with the exception of the US region where only FIPS-approved cryptography may be used. The algorithm will also be included in GitHub Enterprise Server 3.19.
How to check if my OpenSSH supports post-quantum key exchange?
Run the command 'ssh -Q kex' to list all supported key exchange algorithms. If sntrup761x25519-sha512 or [email protected] appears in the output, your client supports it. OpenSSH 9.0 or newer includes this algorithm. To check which algorithm is actually used when connecting to GitHub, run: ssh -v [email protected] exit 2>&1 | grep 'kex: algorithm:'
Does GitHub's post-quantum SSH change affect HTTPS Git access?
No, the post-quantum SSH change only affects SSH connections to GitHub. If your Git remotes start with https://, you won't be impacted at all. The change is specifically about the SSH key exchange algorithm used when establishing SSH connections for Git operations. HTTPS access remains unchanged by this update.
What happens if my SSH client doesn't support post-quantum algorithms?
If your SSH client doesn't support sntrup761x25519-sha512, it will automatically fall back to an older, classical key exchange algorithm. The SSH protocol negotiates algorithms supported by both sides, so your connection will continue to work normally. However, you won't benefit from the post-quantum security until you upgrade to OpenSSH 9.0 or newer.
Why does GitHub use a hybrid post-quantum algorithm instead of pure post-quantum?
GitHub uses a hybrid approach combining Streamlined NTRU Prime (post-quantum) with X25519 (classical) because post-quantum algorithms are newer and have received less cryptographic testing. By combining both, the hybrid algorithm guarantees that security is at least as strong as the classical algorithm alone. If the post-quantum component is later found to have weaknesses, the classical component still provides proven protection.
Why is GitHub's post-quantum SSH not available in the US data residency region?
GitHub Enterprise Cloud with data residency in the United States region is excluded because only FIPS-approved cryptography may be used within that region. The sntrup761x25519-sha512 post-quantum algorithm is not yet approved by FIPS. GitHub plans to update offerings as SSH libraries begin supporting additional post-quantum algorithms that comply with FIPS requirements.
Technologies & Tools
Protocol
SSH
Secure protocol for accessing Git data on GitHub
Cryptography
Streamlined Ntru Prime
Post-quantum-secure key exchange algorithm (sntrup761)
Cryptography
X25519
Classical Elliptic Curve Diffie-Hellman curve used in hybrid key exchange
Tool
Openssh
SSH client implementation that supports the new post-quantum algorithm from version 9.0+
Version Control
Git
Version control system that uses SSH for remote data access
Platform
Github Enterprise Server
Self-hosted GitHub that will include the algorithm in version 3.19
Platform
Github Enterprise Cloud
Cloud-hosted GitHub with data residency support for the new algorithm
Key Actionable Insights
1Check your OpenSSH version and upgrade to 9.0 or newer to automatically benefit from post-quantum key exchange when connecting to GitHub over SSH. Run 'ssh -Q kex' to verify support for sntrup761x25519-sha512.OpenSSH 9.0+ includes this algorithm by default and will prefer it automatically during key exchange negotiation, requiring no manual configuration changes.
2Verify which key exchange algorithm your SSH client actually negotiates with GitHub by running 'ssh -v [email protected] exit 2>&1 | grep kex: algorithm:' after the change takes effect on September 17, 2025. This confirms you're getting post-quantum protection.Even if your client supports the algorithm, custom SSH configurations may override defaults. This diagnostic command helps confirm the negotiated algorithm.
3If you manage corporate SSH configurations that restrict key exchange algorithms (via KexAlgorithms in ssh_config), ensure sntrup761x25519-sha512 or [email protected] is included in the allowed list to benefit from post-quantum security.Organizations that have hardened SSH configurations may inadvertently block the new algorithm. Review and update allowed algorithm lists before the September 2025 rollout.
4Be aware that GitHub Enterprise Cloud with US data residency and GitHub Enterprise Server versions before 3.19 will not support this post-quantum algorithm. Plan upgrade timelines accordingly if you use these products.FIPS compliance requirements prevent the US region from using this algorithm until it receives FIPS approval. Enterprise Server users should plan to upgrade to version 3.19 when available.
5Consider the 'store now, decrypt later' threat model when evaluating the urgency of adopting post-quantum cryptography for your own services beyond GitHub. Any encrypted traffic captured today could potentially be decrypted by future quantum computers.This threat is particularly relevant for long-lived secrets, sensitive source code, and proprietary data transmitted over SSH that would still be valuable years from now.
Common Pitfalls
1
Assuming HTTPS Git access is affected by this change. The post-quantum SSH algorithm only applies to SSH connections. If your Git remotes use https:// URLs, this change has no impact on your workflow whatsoever.
Check your remote URLs with 'git remote -v' to determine whether you use SSH or HTTPS for GitHub access.
2
Using a custom SSH configuration that restricts key exchange algorithms (KexAlgorithms directive) without including the new sntrup761x25519-sha512 algorithm. This would prevent your client from negotiating the post-quantum algorithm even if your OpenSSH version supports it.
Review ~/.ssh/config and any system-wide SSH configuration files for KexAlgorithms restrictions before the September 2025 rollout.
3
Expecting post-quantum SSH support in GitHub Enterprise Cloud's US data residency region. Only FIPS-approved cryptography is permitted in the US region, and this algorithm is not FIPS-approved, so it will not be available there.
Organizations in the US region will need to wait until FIPS-compliant post-quantum algorithms are supported by GitHub's SSH libraries.
4
Running an older SSH client and assuming you still get post-quantum protection. Clients that don't support sntrup761x25519-sha512 will silently fall back to classical algorithms, providing no quantum resistance while still connecting successfully.
Upgrade to OpenSSH 9.0+ and verify the negotiated algorithm using 'ssh -v' to confirm post-quantum protection is active.
Related Concepts
Post-quantum Cryptography
Key Exchange Algorithms
Elliptic Curve Diffie-hellman
Ntru Prime Lattice-based Cryptography
Hybrid Cryptographic Schemes
Fips Compliance
Store Now Decrypt Later Attacks
SSH Protocol Negotiation
Quantum Computing Threats To Encryption
Nist Post-quantum Cryptography Standards