Post Quantum SSH Key Exchange Algorithms

[Bryce Larson]

When doing git clones, pulls, pushes, etc. I'm getting this warning:

```

** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
```

This leads me to believe that bitbucket servers don't support post quantum key exchange algorithms for ssh access to git.  Can we get that added soon?

[anarchitech]

ssh -v -F none git@bitbucket.org

Bitbucket is not using a pq algorithm,  using curve25519-sha256 , hence openssh is throwing that warning:

debug1: kex: algorithm: curve25519-sha256@libssh.org

debug1: kex: host key algorithm: rsa-sha2-512

debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none

debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none

For comparison, github is running a hybrid pq algorithm, so it's pq compliant and won't throw the warning:

debug1: kex: algorithm: sntrup761x25519-SHA512

debug1: kex: host key algorithm: ssh-ed25519

debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none

debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none

Hybrid Streamlined NTRU Prime sntrup761 and X25519 with SHA-512: sntrup761+x25519+sha512 

FWIW, some Linux distros running openssh appear to have incorrect config files and fail to show the warning.   

[Abhay Gupta]

We have created a BCLOUD to address this and here is the link to the BCLOUD for your reference:
BCLOUD-23914

[Jim Knepley - ReleaseTEAM]

The issue created makes a good point that you can suppress the warning messages by changing the log level for bitbucket.org in your ssh_config file. It doesn't solve the problem, but could help reduce confusion.

Host bitbucket.org 
    LogLevel ERROR 

[Kuno Meyer]

Or more targeted (from OpenSSH PQ FAQ):

Host bitbucket.org
     WarnWeakCrypto no

[Jan Bom Trap]

I'm experiencing the same Warning on sourcetree enterprice 3.4.45 on windows 11

[Ben Hubbard]

I just received this same message too.  Running EndeavourOS Arch Linux on my dev machine and it just upgraded to OpenSSH 10. 

[16:05:01] [hubbaba ~/dev/RampantStrategy(develop)] ➜ ssh -V 
OpenSSH_10.2p1, OpenSSL 3.6.0 1 Oct 2025

This is going to start becoming a common message that people are going to see, so I'd suggest adding it to the roadmap.  Seeing a big warning sign every time I commit just makes me nervous.  

[Jim Knepley - ReleaseTEAM]

Hi @Bryce Larson 

I don't have any special insight into the Bitbucket roadmap; it might already be in progress.

It doesn't look like anyone has opened a feature request ticket, if only to be able to watch it age over the years. I would certainly upvote such a feature.

[ccenvcvb]

Apperantly I can only create tickets for bitbucket server (BSERV) not for bitbucket cloud.

[ccenvcvb]

Created a support ticket, asked the support team to create a feature request.

[ccenvcvb]

ticket BCLOUD-23914