14.1.1.1. Default secure TLS configuration¶

When using the secure value for the ssl_cipher_list, the following algorithms are enabled, with priority from top to bottom. The list is based on the Intermediate` configuration suggested by Mozilla SSL Configuration Generator :

• ECDHE-ECDSA-AES256-GCM-SHA384

• ECDHE-RSA-AES256-GCM-SHA384

• ECDHE-ECDSA-AES128-GCM-SHA256

• ECDHE-RSA-AES128-GCM-SHA256

• ECDHE-ECDSA-CHACHA20-POLY1305

• ECDHE-RSA-CHACHA20-POLY1305

• DHE-RSA-AES128-GCM-SHA256

• DHE-RSA-AES256-GCM-SHA384

This list provides maximum compatibility with existing deployments while avoiding deprecated ciphers.

The secure list is designed to support both TLS 1.2 and TLS 1.3. It is not compatible with TLS 1.1 and older standards. For compatibility with TLS 1.1 or older versions, either use the all list or provide a custom list of ciphers.

SFTPPlus uses the OpenSSL library provided by the Python cryptography module. To benefit from upstream security updates for the bundled OpenSSL library, keep your SFTPPlus deployments always updated. This OpenSSL version might not provide all the ciphers which are required by older SSL/TLS versions of the standard. This is valid especially for cryptographic methods which in recent years were discovered to no longer be secured. While 3DES was considered secure at the beginning of 2016, in August 2016 it was discovered that it is vulnerable to the SWEET32 attack. Therefore, 3DES support is no longer included with latest updates for most operating systems.

To verify the list of ciphers available for your operating system use:

openssl ciphers -V

14.1.1.2. TLS versions¶

• TLS v1.0

• TLS v1.1

• TLS v1.2

• TLS v1.3

14.1.1.3. File formats¶

TLS / X.509 certificates and keys can be stored and read by SFTPPlus in the following formats:

• PKCS #8 / PEM

• PKCS #12 / PFX

14.1.1.4. Public-key cryptographic systems¶

• DSS/DSA

• RSA

14.1.1.5. Key agreement algorithms¶

• DHE, EDH, DH - ephemeral prime factorization Diffie-Hellman (DH) key agreement

• EECDH, ECDHE, ECDH - ephemeral elliptic curve Diffie-Hellman (ECDH) key agreement

For the DH key agreement, SFTPPlus uses a DH parameter for the 2 generator with a size of 2048 bits. Contact us if you require a different DH parameter for your configuration.

14.1.1.6. Hash functions¶

• MD5

• SHA-1 (FIPS 140-2 compatible)

• SHA-2 (for OpenSSL 0.9.8 or newer) (FIPS 140-2 compatible)

14.1.1.7. Encryption algorithms¶

• 3DES (FIPS 140-2 compatible, vulnerable to SWEET32 attacks)

• AES 128 and AES 256 (FIPS 140-2 compatible)

• RC4

• Blowfish

14.1.1.8. Key usage certificate extension¶

When creating a certificate signing request or a self-signed certificate, you can use any of the Key Usage or Extended Key Usage extensions supported by OpenSSL.

In SFTPPlus, extension names are lower case and use hyphens. Both normal and extended key usages values are configured together, without distinguishing between extended and non-extended ones.

Below are the conversion tables.

14.1.2.1. Default SFTP/SCP secure configuration¶

When using the secure value for the ssh_cipher_list, the following algorithms are enabled. These are listed below according to preference:

# Host keys
ssh-ed25519'
ecdsa-sha2-nistp256
ecdsa-sha2-nistp384
ecdsa-sha2-nistp521
rsa-sha2-512
rsa-sha2-256
ssh-rsa

# Ciphers
aes256-gcm@openssh.com
aes128-gcm@openssh.com
aes256-ctr
aes192-ctr
aes128-ctr

# MACs
hmac-sha2-256-etm@openssh.com
hmac-sha2-512-etm@openssh.com
hmac-sha2-256
hmac-sha2-512

# Key Exchanges
# See RFC for current recommendation (check updates).
# This is based on:
# https://tools.ietf.org/id/draft-ietf-curdle-ssh-kex-sha2-09.html
curve25519-sha256 (with OpneSSL 1.1.1 or newer)
curve25519-sha256@libssh.org (with OpneSSL 1.1.1 or newer)
ecdh-sha2-nistp521
ecdh-sha2-nistp384
ecdh-sha2-nistp256
diffie-hellman-group-exchange-sha256
diffie-hellman-group18-sha512
diffie-hellman-group17-sha512
diffie-hellman-group16-sha512
diffie-hellman-group15-sha512
diffie-hellman-group14-sha256

This list provides maximum compatibility with existing deployments while avoiding deprecated ciphers.

14.1.2.2. Public-key cryptographic systems¶

Here is the list of supported public-key cryptographic systems ordered by SFTPPlus' preference during the negotiation phase:

• Ed25519 (ssh-ed25519)

• ECDSA (ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521)

• RSA (rsa-sha2-512, rsa-sha2-256, ssh-rsa)

• DSS/DSA (ssh-dss)

14.1.2.3. SSH Key Exchange¶

Here is the list of supported SSH key exchanges, ordered on the preference of SFTPPlus during the negotiation phase:

• curve25519-sha256

• curve25519-sha256@libssh.org

• ecdh-sha2-nistp521

• ecdh-sha2-nistp384

• ecdh-sha2-nistp256

• diffie-hellman-group-exchange-sha256 (FIPS 140-2 compatible)

• diffie-hellman-group-exchange-sha1 (FIPS 140-2 compatible)

• diffie-hellman-group14-sha1 (FIPS 140-2 compatible)

• diffie-hellman-group1-sha1 (FIPS 140-2 compatible, but no longer considered secure to modern standards)

• diffie-hellman-group14-sha256 (RFC 8268 for transition to newer group sizes)

• diffie-hellman-group15-sha512 (RFC8268)

• diffie-hellman-group16-sha512 (RFC8268)

• diffie-hellman-group17-sha512 (RFC8268)

• diffie-hellman-group18-sha512 (RFC8268)

The fixed group prime numbers are the one specified in RFC3526.

14.1.2.4. Keyed-hash message authentication code (HMAC)¶

Here is the list of supported HMAC, ordered on the preference of SFTPPlus during the negotiation phase:

• hmac-sha2-256-etm@openssh.com

• hmac-sha2-512-etm@openssh.com

• hmac-sha2-512 (FIPS 140-2 compatible)

• hmac-sha2-256 (FIPS 140-2 compatible)

• hmac-sha1 (FIPS 140-2 compatible)

• hmac-md5

14.1.2.5. Symmetric encryption algorithms¶

Here is the list of supported symmetric encryption algorithms, ordered on the preference of SFTPPlus during the negotiation phase:

• aes256-gcm@openssh.com

• aes128-gcm@openssh.com

• aes256-ctr, aes256-cbc, aes192-ctr, aes192-cbc, aes128-ctr, aes128-cbc (FIPS 140-2 compatible)

• cast128-ctr, cast128-cbc

• blowfish-ctr, blowfish-cbc

• 3des-ctr, 3des-cbc (FIPS 140-2 compatible, vulnerable to SWEET32 attacks)

The AES Galois Counter Mode for the Secure Shell Transport Layer Protocol is specified as part of RFC 5647. In SFTPPlus the GCM support is implemented based on the OpenSSH specification. AES-GCM is available as the cipher algorithms "aes128-gcm@openssh.com" or "aes256-gcm@openssh.com" and never as an MAC algorithm. If AES-GCM is selected as the cipher the negotiated MAC algorithms are ignored and there doesn't have to be a matching MAC.

14.1.4.1. Public-key cryptographic systems¶

• DSS/DSA

• RSA (RSA-E, RSA-S)

• ELG-E

14.1.4.2. Hash functions¶

• MD5

• SHA1

• RIPEMD160

• SHA256

• SHA384

• SHA512

• SHA224

14.1.4.3. Symmetric encryption algorithms¶

• IDEA

• 3DES

• CAST5

• BLOWFISH

• AES (AES128)

• AES192

• AES256

• TWOFISH

• CAMELLIA128

• CAMELLIA192

• CAMELLIA256

14.1.4.4. Compression¶

• Uncompressed

• ZIP

• ZLIB

14.1.5.1. TOTP - Time-Based One-Time Passwords¶

The Time-Based One-Time Password (TOTP) authentication method adds an extra layer of security on top of the usual username/password credentials.

A unique code valid for a limited number of seconds is used for validation.

The code is generated using helper applications like Google Authenticator or FreeOTP.

To use a unique password per session, this unique code has to be added at the end of the regular password. By appending the unique code to the regular password, the new method of authentication is still compatible with the traditional username and password authentication system. No extra changes are required for the file transfer client.

This implements a two factor authentication method (2FA) in which both the password and the unique code are used to authenticate the connection.

SFTPPlus supports the TOTP algorithm as defined in RFC 6238

The following parameters are supported: * 6 digits * 30 seconds interval * SHA1

Two-factor authentication will succeed as long as the received token is within one time step of 30 seconds (+/- 30s).

Authenticating twice with the same multi-factor authentication token will fail. This prevents replay attacks.