# Security Enhancement: Allow stronger SSH keys for Git-based theme/component installation

**URL:** https://meta.discourse.org/t/security-enhancement-allow-stronger-ssh-keys-for-git-based-theme-component-installation/379821
**Category:** Feature
**Tags:** development
**Created:** [August 22, 2025, 11:57am UTC](https://meta.discourse.org/t/security-enhancement-allow-stronger-ssh-keys-for-git-based-theme-component-installation/379821 "2025-08-22T11:57:55Z")
**Posts on this page:** 1
**Showing post:** 1

<div class="post-metadata">

### Author: ![JBdama](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jbdama/32/518748_2.png) [@JBdama](https://meta.discourse.org/u/JBdama)
#### Post date: [August 22, 2025, 11:57am UTC](https://meta.discourse.org/t/security-enhancement-allow-stronger-ssh-keys-for-git-based-theme-component-installation/379821/1 "2025-08-22T11:57:55Z")

</div>

**Problem:**  
When installing a theme or component from a private Git repository using the “Install from a git repository” option, Discourse automatically generates a **2048-bit RSA SSH keypair** for the user to add as a deploy key.

Our private Git server (Gitea, though this would affect any security-conscious Git host) has a security policy that **rejects 2048-bit RSA keys** , requiring a minimum of 3072 bits. This is in line with modern security best practices, as 2048-bit RSA is now considered the minimum standard and is being phased out (NIST recommends transitioning to stronger algorithms by 2030).

**Feature Request:**  
I would like to request an enhancement to this feature to provide more secure and flexible key generation options. Ideally, the interface could:

1. **Generate a stronger key by default:** Move to generating **Ed25519** keys, which are more secure, faster, and have better compatibility with modern security policies than 2048-bit RSA.

2. **Provide a configuration option:** Allow administrators to specify the preferred SSH key algorithm and strength (e.g., in **`discourse.conf`** ) with options like **`rsa:3072`** , **`rsa:4096`** , or **`ed25519`**.

Thank you for considering this enhancement. I believe it would be a valuable improvement for the security and professionalism of the Discourse platform.

---

_[View the full topic](https://meta.discourse.org/t/security-enhancement-allow-stronger-ssh-keys-for-git-based-theme-component-installation/379821)._