GitHub

GitHub Adds Quantum-Resistant SSH Key Exchange to Protect Git Data in Transit

Honghao Wang

— 2 min read 
# GitHub Introduces Hybrid Post‑Quantum SSH Key Exchange

GitHub is [rolling out a hybrid post‑quantum secure key exchange algorithm](https://github.blog/engineering/platform-security/post-quantum-security-for-ssh-access-on-github) for SSH access when using Git over SSH.  
The new algorithm:

**`sntrup761x25519-sha512`**  
(*also known as `sntrup761x25519-sha512@openssh.com`*)

Combines:
- [Streamlined NTRU Prime](https://ntruprime.cr.yp.to/) — **post‑quantum cryptography scheme**
- [X25519](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/x25519/) — **classical elliptic‑curve algorithm**

**Goal:** Protect Git data from future **quantum computing threats** that could decrypt SSH sessions recorded today.

---

## Rollout Timeline & Scope

- **Start date:** September 17, 2025
- **Applies to:** SSH endpoints for Git data (**not HTTPS**)
- **Regions:** GitHub.com and non‑US GitHub Enterprise Cloud
- **US exclusion:** Due to stricter [FIPS standards](https://learn.microsoft.com/en-us/compliance/regulatory/offering-fips-140-2) (algorithm not yet FIPS‑approved)
- **GitHub Enterprise Server:** Will include PQ option in **version 3.19**

---

## Why Post‑Quantum Cryptography Matters

**Post‑quantum cryptography (PQC)** is a new class of algorithms resistant to attacks from quantum computers.  
Traditional schemes like:
- [RSA](https://www.rsa.com/)
- [Elliptic Curve Cryptography (ECC)](https://www.geeksforgeeks.org/ethical-hacking/blockchain-elliptic-curve-cryptography/)

…depend on problems (integer factorization, discrete logarithms) that quantum computers can solve efficiently via algorithms like [Shor’s Algorithm](https://www.fortinet.com/resources/cyberglossary/shors-grovers-algorithms).

**Risk:** "Store now, decrypt later" — attackers record encrypted traffic now, decrypt when quantum capability arrives.

---

## Industry Initiatives

Organizations and researchers, including the [NIST PQC Project](https://csrc.nist.gov/projects/post-quantum-cryptography), are developing **quantum‑safe algorithms** based on:
- [Lattice problems](https://en.wikipedia.org/wiki/Lattice-based_cryptography)
- [Code-based cryptography](https://utimaco.com/service/knowledge-base/post-quantum-cryptography/what-code-based-cryptography)
- [Multivariate equations](https://www.khanacademy.org/math/multivariable-calculus/thinking-about-multivariable-function/ways-to-represent-multivariable-functions/a/multivariable-functions)

**Hybrid configurations** — combining classical and PQ algorithms — maintain current compatibility while preparing for future threats.

---

## GitHub User Impact

**Good news:** Most Git SSH workflows will work without change.

If your SSH client supports the algorithm — e.g. **OpenSSH 9.0+** — it will **automatically prefer it** unless overridden.

Older clients simply continue using classical key exchanges.

### Useful Commands

- List supported key exchanges:

ssh -Q kex

- Check algorithm used during connection:

ssh -v git@github.com exit | grep 'kex: algorithm:'


---

## Alignment with OpenSSH Progress

- **OpenSSH 9.0 (Apr 2022):** Added `sntrup761x25519-sha512`
- **OpenSSH 9.9:** Introduced `mlkem768x25519-sha256`
- **OpenSSH 10.0:** Made `mlkem768x25519-sha256` default

GitHub’s implementation closely tracks this **hybrid PQC adoption path**.

---

## Other Post‑Quantum SSH Solutions

### SSH.com — Tectia Quantum‑Safe Edition
- Combines classical encryption with PQ algorithms:
  - [Crystals/Kyber](https://medium.com/identity-beyond-borders/crystals-kyber-the-key-to-post-quantum-encryption-3154b305e7bd)
  - [FrodoKem](https://frodokem.org/)
  - [NTRU](https://ntru.org/)
- Supports **FIPS mode** and classical SSH compatibility.

### TinySSH
- Minimal SSH server
- Supports **hybrid PQC** key exchange:
  - NTRU Prime + [ED25519](https://en.wikipedia.org/wiki/Curve25519)
- Used experimentally for **quantum‑forward secrecy**.

---

## Distributing PQC Knowledge & Updates

With rapid adoption of PQC, **multi‑platform content distribution** is essential for education and awareness.

Platforms like [AiToEarn官网](https://aitoearn.ai/) provide:
- **Open‑source AI monetization framework**
- Generate, distribute, and monetize AI‑generated content
- Publish simultaneously to:
  - GitHub Pages
  - Douyin, Kwai, WeChat
  - Bilibili, Rednote (Xiaohongshu)
  - Facebook, Instagram, LinkedIn, Threads
  - YouTube, Pinterest, X (Twitter)
- Integrated analytics & [AI model rankings](https://rank.aitoearn.ai)

**Benefit:** Ensure technical updates — such as quantum‑safe SSH best practices — reach a global audience quickly.

---

## Key Takeaways

- **Hybrid PQC SSH** protects against future quantum attacks while keeping compatibility.
- GitHub’s rollout is part of a larger industry shift led by OpenSSH, NIST, and tools like Tectia & TinySSH.
- Both **security professionals** and **content creators** need platforms to share critical PQC knowledge effectively.
- Just as post‑quantum cryptography future‑proofs secure communications, **AI‑powered publishing ecosystems** future‑proof technical outreach.

Read more