Connection Encryption and Algorithm Selection

Files.com supports multiple encryption algorithms so that different clients can establish protected connections. The supported list describes what a service accepts; a connection record describes what a particular client and service selected. These answer different questions when you review a connection against your organization's requirements.

Transport Protection and Server Identity

An encrypted connection protects file contents and credentials while they travel between the participating systems. It does not determine who may read the file after delivery. Storage encryption and GPG file encryption address different parts of that lifecycle.

Use HTTPS or FTPS with certificate verification, or SFTP with host-key verification, to establish both an encrypted connection and the intended server's identity. A connection that encrypts traffic but does not verify its destination omits the identity check. An SFTP server host key is separate from an SSH key used to authenticate a Files.com user.

A TLS certificate must cover the hostname the client uses, and that hostname must be configured for your Files.com site. A wildcard certificate does not make every matching hostname a configured Files.com domain. For a customer-provided certificate, use the exact CNAME destination shown in the Custom Domain interface; do not infer it from the site's first domain. TLS Certificates and SFTP Host Keys explain the corresponding setup and verification.

Supported and Selected Algorithms

HTTPS and FTPS use TLS. SFTP uses SSH, with separate choices for key exchange, server identity, encryption, and message integrity. The Ciphers page lists the supported algorithms for each protocol.

The client and service must agree on algorithms they both support. For SSH, the client's preference order determines the selected encryption and message authentication algorithms among the choices the server accepts, as defined by SSH algorithm negotiation. A supported newer algorithm is therefore not proof that a particular connection selected it.

Files.com provides current and historical cipher reporting to identify the algorithms used by your clients. Use those records when assessing an existing integration. A separate connection made by a checking tool establishes what that tool can negotiate, rather than what every customer client uses.

Algorithm Roles

An algorithm's purpose matters as much as its name. For SFTP, key exchange establishes connection keys, a host key authenticates the server, and an encryption algorithm protects the transferred content. A message authentication code (MAC) checks the integrity of the connection's messages. These roles are separate from authenticating a Files.com user or granting folder permissions.

For example, hmac-sha1 names a keyed message authentication algorithm. Its presence in a connection record does not mean that a certificate uses a SHA-1 signature or that file contents use SHA-1 as an encryption algorithm. Files.com's supported SFTP algorithms include this MAC for client compatibility. Organizations can still require a different algorithm through their own connection policy; support by Files.com does not establish compliance with that policy.

Compatibility Settings

Legacy cipher support expands the algorithms permitted on a site. Enabling it changes the choices available to clients; it does not mean that every connection uses a legacy algorithm. It also allows clients to select algorithms that your site's default policy would reject.

Algorithm negotiation occurs before user authentication. Site-wide cipher settings therefore need to account for all clients that connect to the site. Upgrading a client or changing its permitted algorithms addresses that client's requirements without expanding the site's accepted algorithms for everyone.