DataShop SFTP Security Policy Update

SFTP Cipher/MAC Policy Update

Overview

Cboe DataShop is updating the cryptographic algorithms supported by our SFTP service. As part of our commitment to maintaining the highest security standards, we are deprecating older and less secure SSH MAC (Message Authentication Code) algorithms and key exchange methods.

Please review your SFTP client configuration and make necessary updates. We will stagger the update across our production hosts to provide time for testing and confirmation.

Policy Changes - Ciphers & Algorithms

SSH Ciphers

Cipher	Status
`[email protected]`	Supported
`[email protected]`	Supported
`aes128-ctr`	Supported
`aes256-ctr`	Supported
`aes192-ctr`	Supported

SSH Key Exchange Algorithms

Algorithm	Status
`mlkem768x25519-sha256`	NEW - Supported
`mlkem768nistp256-sha256`	NEW - Supported
`mlkem1024nistp384-sha384`	NEW - Supported
`ecdh-sha2-nistp256`	Supported
`ecdh-sha2-nistp384`	Supported
`ecdh-sha2-nistp521`	Supported
`curve25519-sha256`	Supported
`[email protected]`	Supported
`diffie-hellman-group16-sha512`	Supported
`diffie-hellman-group18-sha512`	Supported
`diffie-hellman-group-exchange-sha256`	Supported
`diffie-hellman-group14-sha256`	NO LONGER SUPPORTED
`diffie-hellman-group14-sha1`	NO LONGER SUPPORTED

SSH MAC Algorithms

Algorithm	Status
`[email protected]`	Supported
`[email protected]`	Supported
`[email protected]`	NO LONGER SUPPORTED
`[email protected]`	NO LONGER SUPPORTED
`[email protected]`	NO LONGER SUPPORTED
`[email protected]`	NO LONGER SUPPORTED
`[email protected]`	NO LONGER SUPPORTED
`hmac-sha2-256`	NO LONGER SUPPORTED
`hmac-sha2-512`	NO LONGER SUPPORTED
`hmac-sha1`	NO LONGER SUPPORTED

Schedule - POSTPONED

Please note that our scheduled SFTP update has been postponed; we will share the new date as soon as it is confirmed

SFTP Site	Date
`sftp.datashop.livevol.com`	-
`sftp2.datashop.livevol.com`	-

We are staggering the update of our production hosts so that customers can test against sftp.datashop.livevol.com, while still maintaining existing access via sftp2.datashop.liveol.com Please ensure you can switch between hosts prior to the date of the first change.

Recommended Actions

Customers need to update their SSH clients to use one of the following:

AEAD ciphers (MACs are implicit - no action needed):
- [email protected]
- [email protected]
ETM MAC variants:
- [email protected]
- [email protected]

Recommendations for Common Clients

Client	Recommendation
paramiko	Configure to use AEAD ciphers or update configuration to prefer ETM MACs
WinSCP	Update to latest version and configure cipher preferences in Connection > SSH > Ciphers
JSCH	Upgrade from 0.1.x to 0.2.x series which supports ETM MACs
Renci.SshNet	Update to latest version with AEAD cipher support
SSHJ	Update to version 0.35.0 or later
OpenSSH	Update ssh_config to prefer AEAD ciphers or ETM MACs
PuTTY	Update to latest version and configure cipher/MAC preferences

If you have any questions or encounter issues, please contact us at [email protected]