Connection Encryption and Algorithm Selection

Files.com supports multiple encryption algorithms so that different clients can establish protected connections. The supported list describes what a service accepts; a connection record describes what a particular client and service selected. These answer different questions when you review a connection against your organization's requirements.

Supported and Selected Algorithms

HTTPS and FTPS use TLS. SFTP uses SSH, with separate choices for key exchange, server identity, encryption, and message integrity. The Ciphers page lists the supported algorithms for each protocol.

The client and service must agree on algorithms they both support. For SSH, the client's preference order determines the selected encryption and message authentication algorithms among the choices the server accepts, as defined by SSH algorithm negotiation. A supported newer algorithm is therefore not proof that a particular connection selected it.

Files.com provides current and historical cipher reporting to identify the algorithms used by your clients. Use those records when assessing an existing integration. A separate connection made by a checking tool establishes what that tool can negotiate, rather than what every customer client uses.

Algorithm Roles

An algorithm's purpose matters as much as its name. For SFTP, key exchange establishes connection keys, a host key authenticates the server, and an encryption algorithm protects the transferred content. A message authentication code (MAC) checks the integrity of the connection's messages. These roles are separate from authenticating a Files.com user or granting folder permissions.

For example, hmac-sha1 names a keyed message authentication algorithm. Its presence in a connection record does not mean that a certificate uses a SHA-1 signature or that file contents use SHA-1 as an encryption algorithm. Files.com's supported SFTP algorithms include this MAC for client compatibility. Organizations can still require a different algorithm through their own connection policy; support by Files.com does not establish compliance with that policy.

Compatibility Settings

Legacy cipher support expands the algorithms permitted on a site. Enabling it changes the choices available to clients; it does not mean that every connection uses a legacy algorithm. It also allows clients to select algorithms that your site's default policy would reject.

Algorithm negotiation occurs before user authentication. Site-wide cipher settings therefore need to account for all clients that connect to the site. Upgrading a client or changing its permitted algorithms addresses that client's requirements without expanding the site's accepted algorithms for everyone.