Most people interested in security will have heard about the threat quantum computers pose to currently used encryption. Consequently, post-quantum cryptography is an active field of research which finally led to standardisation of some post quantum cryptography algorithms.
Different software and services have started to support these algorithms out of the box one of them being OpenSSH. It not only supports hybrid key exchange but since version 10.1 warns if an ssh server doesn’t support it.
WARNING: connection is not using a post-quantum key exchange algorithm This session may be vulnerable to “store now, decrypt later” attacks. The server may need to be upgraded. See https://openssh.com/pq.html
This is exactly what currently happens when you access a git repo at Bitbucket via ssh. Of course I’m not the only one who noticed and someone opened an issue in the public Bitbucket issue tracker.
I was surprised when I saw the only reaction to it. It wasn’t a statement if or when they will support a post-quantum key exchange algorithm or why they wouldn’t at the moment. Instead someone just recommended to suppress the warning.
Of course, you could argue that Harvest now, decrypt later isn’t a real threat to git repos. After all you probably shouldn’t store so sensitive data in a git repo at a cloud provider. On the other hand other public providers such as Github have implemented post-quantum key exchange algorithms.
And in any case “solving” a security issue simply by disabling the warning seems to be the wrong mindset.
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.