Does GitHub's post-quantum key exchange replace my SSH account key?
No. The hybrid ML-KEM key exchange establishes a session secret between client and server, while the SSH key signature authenticates the account. They are separate parts of the handshake and should be checked independently.
Answered in
GitHub’s SSH Brownout Starts Nov. 4: Check the Client Before Replacing KeysGitHub is phasing out older SSH signatures and key exchange; distinguish RSA key files from the SHA-1 signature algorithm before changing access.
Read the full analysisOther questions this article answers
More tech questions
- Does GitHub public monitoring scan an enterprise’s private repositories?
- How does GitHub attribute a public secret to a data-residency enterprise?
- Who can use public monitoring with data residency?
- Does IBM Unified Key Orchestrator for Secure Room Operation make an organization post-quantum secure?
- What does dual control mean in secure key operations?
- Where should an organization begin a post-quantum migration?
- What does a forward-deployed engineer do on an AI project?
- Does a one-gigawatt virtual power plant generate one gigawatt of electricity?
Every answer on Crashtech is written by the editor of the article it comes from — never auto-summarised. Browse all answers or the Tech beat.