Go Back   FlashFXP Forums > >

General Discussion Need help? Have a problem? Let us help you. Bug reports and feature requests should be made using the Bug Tracker or Feature Tracker

 
 
Thread Tools Rate Thread Display Modes
Prev Previous Post   Next Post Next
Old 12-17-2015, 12:06 PM   #2
bigstar
FlashFXP Developer
FlashFXP Administrator
ioFTPD Beta Tester
 
bigstar's Avatar
 
Join Date: Oct 2001
Posts: 8,012
Default

The problem is caused by the SecureBlackBox library used by FlashFXP and FileCOPA

When SecureBlackBox added support for AES-GSM encryption they added it using the RFC standard, then they added support for AES-GSM@openssh.com which is a variant of the RFC standard, at the same time they back-tracked on the original AES-GSM encryption code and changed it to use the @openssh.com variant breaking interpolation between the client and server.

The issue was quickly resolved in the next SecureBlackBox update.

The problem is that last time I checked FileCOPA was still using an older edition of the SecureBlackBox library. I attempted to contact the developer of FileCOPA to discuss this serious issue but they never responded.

You can work around the problem in FlashFXP by unchecking the aes256-gsm and aes128-gsm ciphers via the Site Manager / SFTP tab. Or if you prefer to turn it off globally you can via the Preferences dialog / SFTP Encryption. This will turn off these bugged ciphers and allow FlashFXP to use another compatible cipher.

GCM mode ciphers provide both privacy (encryption) and integrity (MAC), Since the MAC is defined by the cipher its implicit. Other ciphers only provide encryption and the MAC is calculated in a separate step.
bigstar is offline  
 

Tags
flashfxp, sftp, [r], server, key, connection, log, [113501], mac, settings


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT -5. The time now is 08:53 AM.

Parts of this site powered by vBulletin Mods & Addons from DragonByte Technologies Ltd. (Details)