This page describes the cryptography method, protocols, and algorithms supported by SFTPPlus.
The secure file transfer services implemented in FTPS and HTTPS are based on the Transport Layer Security (TLS) protocol, which is the successor of the Secure Sockets Layer (SSL) protocol.
Note
SSL version 2 is not supported and it was officially deprecated in 2011 by the RFC 6176.
SSL version 3 is supported in order to provide backward compatibility for older clients, but it is not recommended for new deployments. It was officially deprecated in June 2015 by the RFC 7568.
Modern Unix and Linux versions are distributed with OpenSSL version 1.0.1 or newer.
Windows is distributed without OpenSSL. SFTPPlus for Windows is distributed with embedded OpenSSL 1.0.2g.
For older operating systems, we provide for your convenience a list of the OpenSSL versions offered by the OS vendors. This list is not comprehensive and comes with no guarantee. Last updated on February 17, 2016.
Note
DSS/DSA key support is provided for backward compatibility.
Newer deployments should be based on RSA, use key size of 4096 or greater.
DSS/DSA key support is scheduled to be removed/deprecated with the future release of TLS v1.3.
Note
All modern operating systems, still supported by their vendors, provide newer versions of OpenSSL with support for SHA-2. We are aware of Solaris 10 and Red Hat Enterprise Linux 4 which don’t have SHA-2 support.
Only SSH version 2 is supported.
SFTP is implemented based on draft version 3.
SCP is not a standard protocol, therefore it was implemented based on the public source code of OpenSSH’s implementation.
Here is the list of supported public-key cryptographic systems, ordered on the preference of SFTPPlus during the negotiation phase:
Note
Newer deployments should be based on RSA with key size of 4096 or greater.
Here is the list of supported SSH key exchanges, ordered on the preference of SFTPPlus during the negotiation phase:
Here is the list of supported HMAC, ordered on the preference of SFTPPlus during the negotiation phase:
Here is the list of supported symmetric encryption algorithms, ordered on the preference of SFTPPlus during the negotiation phase:
While SFTPPlus is not FIPS 140-2 certified and does not have a certification number, it can be configured to run with a set of ciphers and cryptographic algorithms that are complaint to the FIPS 140-2 standard.
We believe that we have followed the requirements laid out in the FIPS 140-2 computer security standard for Security Level 1 and that SFTPPlus meets those requirements.