DataShop SFTP Security Policy Update

SFTP Cipher/MAC Policy Update

Overview

Cboe DataShop is updating the cryptographic algorithms supported by our SFTP service. As part of our commitment to maintaining the highest security standards, we are deprecating older and less secure SSH MAC (Message Authentication Code) algorithms and key exchange methods.

Please review your SFTP client configuration and make necessary updates.

The update will be rolled out in a staggered manner across production hosts to minimize impact and ensure service stability.

Policy Changes - Ciphers & Algorithms

SSH Ciphers

Cipher	Status
`[email protected]`	Supported
`[email protected]`	Supported
`aes128-ctr`	Supported
`aes256-ctr`	Supported
`aes192-ctr`	Supported

SSH Key Exchange Algorithms

Algorithm	Status
`mlkem768x25519-sha256`	NEW - Supported
`mlkem768nistp256-sha256`	NEW - Supported
`mlkem1024nistp384-sha384`	NEW - Supported
`ecdh-sha2-nistp256`	Supported
`ecdh-sha2-nistp384`	Supported
`ecdh-sha2-nistp521`	Supported
`curve25519-sha256`	Supported
`[email protected]`	Supported
`diffie-hellman-group16-sha512`	Supported
`diffie-hellman-group18-sha512`	Supported
`diffie-hellman-group-exchange-sha256`	Supported
`diffie-hellman-group14-sha256`	NO LONGER SUPPORTED
`diffie-hellman-group14-sha1`	NO LONGER SUPPORTED

SSH MAC Algorithms

Algorithm	Status
`[email protected]`	Supported
`[email protected]`	Supported
`[email protected]`	NO LONGER SUPPORTED
`[email protected]`	NO LONGER SUPPORTED
`[email protected]`	NO LONGER SUPPORTED
`[email protected]`	NO LONGER SUPPORTED
`[email protected]`	NO LONGER SUPPORTED
`hmac-sha2-256`	NO LONGER SUPPORTED
`hmac-sha2-512`	NO LONGER SUPPORTED
`hmac-sha1`	NO LONGER SUPPORTED

Testing

To support this security policy update, we will make a new SFTP endpoint available for a limited time. Customers are encouraged to update their configurations and validate connectivity against this new endpoint prior to the enforcement date.

A successful connection to the test SFTP endpoint will authenticate successfully and display a Success.txt file.

SFTP Testing Site
`sftpcert2.datashop.livevol.com`

Schedule

The update will be staggard across our production hosts. Please ensure you can switch between hosts prior to the date of the first change.

SFTP Site	Date
`sftp.datashop.livevol.com`	08/03/2026 7AM CST
`sftp2.datashop.livevol.com`	09/03/2026 7AM CST

Recommended Actions

Customers need to update their SSH clients to use one of the following:

AEAD ciphers (MACs are implicit - no action needed):
- [email protected]
- [email protected]
ETM MAC variants:
- [email protected]
- [email protected]

Recommendations for Common Clients

Client	Recommendation
paramiko	Configure to use AEAD ciphers or update configuration to prefer ETM MACs
WinSCP	Update to latest version and configure cipher preferences in Connection > SSH > Ciphers
JSCH	Upgrade from 0.1.x to 0.2.x series which supports ETM MACs
Renci.SshNet	Update to latest version with AEAD cipher support
SSHJ	Update to version 0.35.0 or later
OpenSSH	Update ssh_config to prefer AEAD ciphers or ETM MACs
PuTTY	Update to latest version and configure cipher/MAC preferences

If you have any questions or encounter issues, please contact us at [email protected]