Home / Companies / GitHub / Blog / Post Details
Content Deep Dive

Discontinue support for weak cryptographic standards

Blog post from GitHub

Post Details
Company
Date Published
Author
Patrick Toomey
Word Count
799
Language
English
Hacker News Points
-
Summary

GitHub has announced the deprecation and eventual disablement of certain outdated cryptographic standards, specifically TLSv1, TLSv1.1, diffie-hellman-group1-sha1, and diffie-hellman-group14-sha1, due to evolving security threats and recent cryptographic attacks like POODLE and Logjam. These changes will take effect on February 1, 2018, and are intended to strengthen security for all GitHub users, as these older standards have been deemed susceptible to vulnerabilities. The majority of HTTPS and SSH connections to GitHub already use more secure algorithms, such as TLS 1.2 and contemporary SSH key exchange algorithms, which will not be affected. However, a minority of clients still rely on the older standards, prompting GitHub to update its SSH implementation to support diffie-hellman-group-exchange-sha256, thereby minimizing the impact. GitHub plans to post quarterly updates and reach out to projects potentially affected by this change to ensure a smooth transition, encouraging developers to upgrade their systems and libraries in advance.