Cryptography for Managed File Transfers

Review the modern protocols, ciphers, and OpenSSL support used by SFTPPlus MFT to protect file transfers.

Published
2026-08-04
Tags
securitysolutions

SFTPPlus MFT protects file transfers with modern cryptographic protocols, current cipher configurations, and flexible methods for validating the identity of remote servers.

Current OpenSSL and Modern Ciphers ​

SFTPPlus uses the latest supported version of OpenSSL, with support for modern ciphers used by TLS, SSH, and other secure transfer protocols. The built-in secure cipher configuration is updated as cryptographic guidance changes, helping new deployments avoid protocols and algorithms that are no longer considered safe.

The supported cryptographic standards documentation lists the available protocols, ciphers, key types, and file formats.

SSH Cryptography ​

SFTPPlus uses OpenSSL for the low-level cryptographic operations required by SSH and SFTP. These operations support SSH key exchange, host keys, encryption, and message authentication.

SSH and TLS are separate security protocol families. The SSH ciphers available to SFTP and SCP therefore have different names and negotiation rules from the TLS cipher suites used by HTTPS and FTPS, even when both protocols use related cryptographic algorithms. A cipher suite configured for TLS cannot be used as an SSH cipher, and the reverse is also true.

SFTPPlus supports modern SSH ciphers, key exchange methods, host key algorithms, and message authentication methods. We continue to add modern methods as SSH standards and commonly used implementations evolve.

Administrators can define a fine-grained SSH cipher suite, including the list of accepted SSH host key algorithms. The supported host key algorithms include:

  • ssh-ed25519
  • ecdsa-sha2-nistp256
  • ecdsa-sha2-nistp384
  • ecdsa-sha2-nistp521
  • rsa-sha2-512
  • rsa-sha2-256
  • ssh-rsa

Additional algorithms are added as SSH support evolves.

Supported symmetric SSH ciphers include aes256-gcm@openssh.com and aes128-gcm@openssh.com.

For message authentication, SFTPPlus supports the encrypt-then-MAC algorithms hmac-sha2-256-etm@openssh.com and hmac-sha2-512-etm@openssh.com, alongside the traditional hmac-sha2-256 and hmac-sha2-512 algorithms. The hmac-sha1 and hmac-md5 algorithms remain available for connections to legacy systems.