Ciphers

Ciphers, also known as cipher suites, are the encryption technology used under the hood when data moves to and from Files.com over SSL/TLS. Files.com follows industry best practices for choosing secure encryption technologies, and balances that against long-term compatibility for customer applications.

Files.com requires modern, secure encryption by default. A separate setting allows connections to negotiate legacy ciphers with known weaknesses so that outdated clients, systems, and devices can connect.

We do not recommend enabling that setting. It applies to your entire site and cannot be limited to the clients that need it, so accommodating one outdated system expands the algorithms available to every client. Enable it only when a business-critical client cannot negotiate modern ciphers and cannot be upgraded.

If your site already allows legacy ciphers, determine which ciphers are being used to find the connections that still depend on them. The reports give you current and historical information about how each of your users' connections are affected, so you can upgrade the affected clients and then turn the setting back off.

Files.com maintains separate default and legacy cipher options so that older-client compatibility requires an explicit site-wide choice.

A Note About the Term SSL / TLS

TLS is the modern standard that replaces SSL. When either term appears without a specific version number (such as TLSv1.3), our documentation and website use TLS and SSL interchangeably.

Default Secure Ciphers

By default, Files.com uses TLS v1.3 for HTTP connections and TLS v1.2 for FTP. TLS v1.2 is also supported for HTTP and is configured to provide the same level of security as TLS v1.3.

Our SSL configuration holds an A+ Rating from the Qualys SSL grader.

HTTPS

Files.com supports the following TLS v1.3 cipher suites for HTTPS:

TLS_AKE_WITH_AES_256_GCM_SHA384 (ecdh_x25519)
TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519)
TLS_AKE_WITH_AES_128_GCM_SHA256 (ecdh_x25519)

Files.com supports the following TLS v1.2 cipher suites for HTTPS:

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519)
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 4096)
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (dh 4096)
TLS_DHE_RSA_WITH_AES_256_CCM_8 (dh 4096)
TLS_DHE_RSA_WITH_AES_256_CCM (dh 4096)

FTPS

Files.com supports the following TLS v1.2 cipher suites for FTPS:

TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 2048)
TLS_RSA_WITH_AES_128_CBC_SHA (rsa 4096)
TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 2048)
TLS_RSA_WITH_AES_256_CBC_SHA (rsa 4096)
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1)
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1)
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (dh 2048)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (secp256r1)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp256r1)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp256r1)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp256r1)
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (dh 2048)
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 2048) 

A Note About CBC Ciphers

The FTPS list includes both CBC and GCM cipher modes to support different clients. A supported algorithm is not necessarily the one a client selects. Connection Encryption and Algorithm Selection explains how to interpret a connection's algorithms alongside your organization's requirements.

SFTP

SFTP does not use TLS or SSL. It implements its own encryption standards and cipher naming.

By default, Files.com supports the following security algorithms for SFTP:

A Note About HMAC-SHA1

Files.com supports hmac-sha1 and hmac-sha1-etm@openssh.com for SFTP client compatibility. These are message authentication algorithms. Algorithm Roles explains how their purpose differs from encryption and certificate signatures, and cipher reporting identifies what your clients use.