Improving Git protocol security on GitHub

We’re changing which keys are supported in SSH and removing unencrypted Git protocol. Only users connecting via SSH or git:// will be affected. If your Git remotes start with https://, nothing in this post will affect you. If you’re an SSH user, read on for the details and timeline.

MC

Matt Cooper, brian m. carlsonGitHub

·September 1, 2021·Application security

Improving Git protocol security on GitHub

Tighter SSH and Git security on GitHub

GitHub’s Git Systems team is updating the security requirements for SSH key types, host keys, and the Git protocol itself. The changes target users connecting via SSH or git://; HTTPS remotes are unaffected. Most users should see little to no disruption, but those on older SSH clients will need to upgrade.

SSH key and algorithm changes

GitHub will no longer accept DSA keys. DSA provides only an 80-bit security level, which is considered weak by modern standards, and fewer than 0.3% of GitHub requests use it. The DSA host key is also being retired.

RSA keys remain supported, but with stricter requirements. Older Git clients often use RSA with SHA-1 signatures, which are insecure. New RSA keys added to GitHub after the change must use SHA-2 signatures (rsa-sha2-256 or rsa-sha2-512). Keys with a valid_after date before November 2, 2021, can continue using SHA-1 for now.

A few legacy SSH algorithms are also being dropped:

hmac-sha1 message authentication code
All CBC ciphers: aes256-cbc, aes192-cbc, aes128-cbc

These are known to be vulnerable to practical attacks, and nearly all clients already offer stronger alternatives.

New host keys

GitHub will add ECDSA and Ed25519 host keys, which are based on elliptic-curve cryptography and provide strong security with smaller key sizes. The new fingerprints are:

ECDSA: SHA256:p2QAMXNIC1TJYWeIOttrVc98/R1BUFWu3/LiyKgUfQM
Ed25519: SHA256:+DiY3wvvV6TuJJhbpZisF/zLDA0zPMSvHdkr4UvCOqU

The host keys themselves will be distributed in advance via OpenSSH’s UpdateHostKeys extension, which cryptographically proves GitHub owns the new keys.

End of unauthenticated Git

The unencrypted git:// protocol will be disabled. It offers no integrity or authentication and is susceptible to tampering. It’s read-only on GitHub, and very few users rely on it.

Timeline and preparation

The changes take effect after November 1, 2021. If you’re using a standard Git client with OpenSSH, verify you’re on version 7.2 or newer with ssh -V. OpenSSH 6.5 or newer works for Ed25519 keys; 5.7 or newer for ECDSA. PuTTY users should upgrade to 0.75 or later.

Add this to your ~/.ssh/config to ease the transition:

Host github.com
    UpdateHostKeys yes

If you use libgit2 or other code built on libssh2, use libssh2 1.9.0 or newer with an ECDSA key, since libssh2 doesn’t yet support RSA with SHA-2. The Go SSH client has the same limitation, so an Ed25519 key is recommended there.

Check your SSH keys for DSA (ssh-dss) and regenerate them as Ed25519 if needed. You can also run the verification script from GitHub’s repository to confirm your configuration.

For git:// users, update any remote URLs to start with ssh://, https://, or [email protected]. Use git remote -v to inspect your remotes and change any that still use git://.

Troubleshooting

If SSH fails after the change, you’re likely on an older operating system or SSH library. Run ssh -vvv [email protected] to see which algorithms your client negotiates. Clients on OpenSSH before 7.2 or PuTTY before 0.75 will need updates. CentOS 6 and Ubuntu 14.* ship with outdated OpenSSH and are end-of-life, so they’re unsupported.