503
NOUS72 KNES 311419
ADMNES
*TOPIC:  *PLANNED PDA RELEASE 4.7 UPDATES TO SFTP SERVER CIPHERS AND MAC
ALGORITHMS



*DATE/TIME ISSUED: * MAY 31, 2024 1406Z



*PRODUCT(S) OR DATA IMPACTED:  *ALL SFTP CONNECTIONS AND RELATED PRODUCTS
TO/FROM THE PDA NSOF OPS SITE.



*DATE/TIME OF INITIAL IMPACT: *JUNE 11, 2024 1200Z



*DATE/TIME OF EXPECTED END: *JUNE 12, 2024 2100Z



*LENGTH OF EVENT:  *33 HOURS



*DETAILS/SPECIFICS OF CHANGE:  *THE PDA TEAM WILL INSTALL PDA RELEASE 4.7
WHICH WILL IMPACT AVAILABLE CIPHERS AND ALGORITHMS WHICH ARE USED DURING
SFTP SERVER HANDSHAKE. THE SPIRIT OF THIS CHANGE IS TO REMOVE VULNERABLE
CIPHERS.  IF YOU CONNECT TO PDA SFTP SERVERS AS A CLIENT THIS CHANGE MAY
AFFECT YOU.



   - *SPECIFICS OF THE CHANGE:*



THE FOLLOWING CIPHERS & MACS WILL BE USABLE AFTER THE REL4.7 UPDATE:

    - AES128CTR

    - AES192CTR

    - AES256CTR

    - AES128CBC

    - AES192CBC

    - AES256CBC

    - TRIPLEDESCBC

    - HMACMD5

    - HMACSHA1

    - HMACMD596

    - HMACSHA196



THE FOLLOWING CIPHERS HAVE BEEN REMOVED:

    - ARCFOUR128

    - ARCFOUR256

    - BLOWFISHCBC



   - *RECOMMENDED ACTION:*

USERS THAT HAVE SFTP CLIENTS THAT CONNECT TO PDA SFTP SERVERS SHOULD VERIFY
THEY SUPPORT ONE OF THE USABLE ALGORITHMS LISTED ABOVE.



   - NOTE: THESE SECURITY UPDATES ARE ONGOING AND FURTHER CHANGES TO OUR
   SFTP SERVERS ARE COMING IN REL4.8 TO ENABLE NEWER MORE SECURE CIPHERS AND
   MAC ALGORITHMS. WHEN WE GET CLOSER TO THE REL4.8 DATE MORE INFORMATION WILL
   BE PROVIDED.



           THE PDA SUPPORT TEAM WILL BE MONITORING THE ENVIRONMENT TO
QUICKLY ADDRESS AND REMEDIATE ANY ISSUES THAT MAY OCCUR.





*CONTACT INFORMATION FOR FURTHER INFORMATION:* ESPC OPERATIONS AT
ESPCOPERATIONS@NOAA.GOV AT 301-817-3880



*WEB SITE(S) FOR APPLICABLE INFORMATION:* N/A

THIS MESSAGE WAS SENT BY ESPC.NOTIFICATION@NOAA.GOV. YOU HAVE BEEN SENT
THIS AND OTHER NOTIFICATIONS BECAUSE YOU HAVE OPTED IN TO RECEIVE IT. IF
FOR ANY REASON, YOU WISH TO UNSUBSCRIBE, PLEASE CONTACT ESPC HELP DESK AT
ESPCOPERATIONS@NOAA.GOV OR (301) 817-3880. PLEASE NOTE: IT MAY TAKE UP TO
TWO BUSINESS DAYS TO PROCESS YOUR UNSUBSCRIBE REQUEST.

=