[Slackbuilds-users] Warning from openssh regarding key exchange

[Karel Venken]

Willy Sudiarto Raharjo wrote:
>> Admins,
>>
>> When I 'git push' an update to the SBo git, this warning pops up:
>>
>> $ git push --set-upstream origin user/kingbeowulf/updates
>> ** WARNING: connection is not using a post-quantum key exchange algorithm.
>> ** This session may be vulnerable to "store now, decrypt later" attacks.
>> ** The server may need to be upgraded. See https://openssh.com/pq.html
>>
>> I do not recall this warning last week or so.
>>
>> Slackware64-15.0 multilib and testing/graphics-updates
>> openssh-10.4p1
>
> you can ignore this warning
> it's part of openssh's warning which is harmless
>
>
> --
> Willy Sudiarto Raharjo
>
> _______________________________________________
> SlackBuilds-users mailing list
> SlackBuilds-users at slackbuilds.org
> https://lists.slackbuilds.org/mailman/listinfo/slackbuilds-users
> Archives - https://lists.slackbuilds.org/pipermail/slackbuilds-users/
> FAQ - https://slackbuilds.org/faq/
>
For whats worth. I noticed the same message when connecting to my 
cluster. I have difference versions of slackware on different systems. 
It typically appears when a recent ssh client connects to an older ssh 
server. I found following explanation, it may be helpful.

== quote ==

The warning refers to the SSH key exchange algorithm, not to the host 
key itself.

Current SSH key exchanges such as ECDH or Curve25519 are secure against 
today's computers, but a sufficiently powerful quantum computer could 
theoretically recover the exchanged session key from a recorded 
handshake. An attacker could therefore record encrypted traffic today 
and decrypt it years later ("store now, decrypt later").

Post-quantum key exchange algorithms are designed to prevent exactly 
this scenario. The warning simply indicates that the server does not yet 
support a post-quantum key exchange. For most day-to-day Git operations 
this is not an immediate security issue, but upgrading OpenSSH on the 
server side will remove the warning and provide protection against 
future quantum attacks.

== unquote ==

Just notice, Slackware itself is not the issue here. The warning depends 
on the OpenSSH version and configuration of the remote server you're 
connecting to. As said. It is harmless unless working in certain conditions.