GitHub sets new SSH security requirements for keys and clients
GitHub is phasing out older SSH cryptography, raising the minimum size for newly uploaded RSA keys and adding a post-quantum key exchange option.
What changed
GitHub says new RSA SSH keys uploaded from 14 October 2026 must be at least 3072 bits. It is also preparing to remove RSA signatures that use SHA-1 and the older diffie-hellman-group-exchange-sha256 key exchange mechanism. On the same October date, GitHub plans to add support for the post-quantum mlkem768x25519-sha256 key exchange on github.com and most GitHub Enterprise Cloud with Data Residency environments.
The later removals will be preceded by brownouts so teams can identify incompatible clients before final enforcement. Existing RSA keys do not automatically need replacing if the SSH client can use RSA with SHA-2.
Why it matters
This is more than a background security hardening change for organizations that depend on Git over SSH. Older developer machines, build servers and third-party tools can fail when legacy algorithms disappear. Buyers and administrators should therefore treat SSH client compatibility as part of their GitHub platform readiness, especially where long-lived CI infrastructure or older enterprise tooling is involved.
Buyer takeaway
GitHub is moving its SSH baseline toward stronger modern cryptography while beginning to introduce post-quantum protection. Teams evaluating GitHub should check whether their development and automation estate uses current SSH implementations. Organizations already using HTTPS remotes are not affected by these SSH connection changes.