Urgent update issued from Unit4 – 10th August 2026.
SFTP: SSH.NET
DSA is no longer supported
Customer action may be required depending on endpoint cryptographic configuration. Customers using DSA keys or legacy cipher and MAC policies will need changes before upgrade.
What changed:
- DSA support was removed in 2025.0.0.
What customers must do:
- Stop using DSA user keys.
- Stop relying on DSA host keys (ssh-dss).
- Migrate to RSA, ECDSA, or Ed25519.
Potential customer symptom if not updated:
- Authentication or host key negotiation failures at connection time.
References:
- 2025.0.0 breaking changes: https://github.com/sshnet/SSH.NET/releases/tag/2025.0.0
Legacy cipher algorithms were dropped
What changed:
- Legacy and insecure cipher algorithms were removed in the 2024.2.0. The removed cipher algorithms are:
- `arcfour`
- `arcfour128`
- `arcfour256`
- `blowfish-cbc`
- `twofish-cbc`
- `twofish128-cbc`
- `twofish192-cbc`
- `twofish256-cbc`
- `cast128-cbc`
What customers must do:
- Ensure their SFTP server offers modern ciphers supported by current SSH.NET.
- Remove dependencies on removed cipher families in server-side policies.
Potential customer symptom if not updated:
- SSH handshake failures due to no common cipher.
References:
- 2024.2.0 breaking changes: https://github.com/sshnet/SSH.NET/releases/tag/2024.2.0
Legacy MAC algorithms were dropped
What changed:
- Legacy MD5-based and truncated HMAC algorithms were removed in the same legacy algorithm cleanup.
- The removed MAC algorithms are:
- `hmac-sha2-512-96`
- `hmac-sha2-256-96`
- `hmac-sha1-96`
- `hmac-md5`
- `hmac-md5-96`
- `hmac-sha1-96-etm@openssh.com`
- `hmac-md5-etm@openssh.com`
- `hmac-md5-96-etm@openssh.com`
What customers must do:
- Ensure server MAC policy includes modern MACs supported by current SSH.NET.
Potential customer symptom if not updated:
- SSH handshake failures due to no common MAC.
References:
- 2024.2.0 breaking changes: https://github.com/sshnet/SSH.NET/releases/tag/2024.2.0
Required customer actions checklist
Customers should validate the following before go-live:
- Their SFTP server does not require DSA keys.
- Their SFTP server host key is not ssh-dss.
- Their SFTP server advertises at least one modern cipher supported by SSH.NET 2025.1.0.
- Their SFTP server advertises at least one modern MAC supported by SSH.NET 2025.1.0.
If you’re unsure whether your SFTP configuration will be affected or need support reviewing your current setup, our team can help. Contact Millennium Consulting today to discuss your requirements and make sure you’re ready for your upcoming upgrade.