We're retiring an outdated security method (called SHA-1) and encouraging a stronger way of logging in (called Public Key Authentication). This keeps your data transfers secure and up to date with modern standards.
In this article, we'll explain why we're making this change and what this means for you. Importantly, we'll explain the actions you must take.
We'll cover:
- Why are we making this change?
- What you need to do
- Upgrade your security: public key authentication
- How to get started with keys
- Next steps
Why are we making this change?
SHA-1 (Secure Hash Algorithm 1) is an aging standard that is no longer considered secure against modern computing threats. To protect your data, we are moving exclusively to SHA-256 and SHA-512 signatures.
What you need to do
To ensure a smooth transition, we will perform "Brownout" tests to help you identify if your systems require updates before the final cutoff.
| Phase | Date | Action |
| Initial Test | Tuesday 3rd Nov 2026 | 24-Hour Disable: SHA-1 will be unavailable for one full day. |
| Final Test | Tuesday 8th Dec 2026 | 72-Hour Disable: SHA-1 will be unavailable for three full days. |
| Full Retirement | Tuesday 12th Jan 2027 | Permanent Disable: SHA-1 will be removed entirely. |
- Manual Users: Update your SFTP client (WinSCP, FileZilla, etc.) to the latest version.
-
Automated Systems: Ensure your libraries (like JSch or Paramiko) are updated to versions that support RSA-SHA2-256 or RSA-SHA2-512. You will need to contact any partner you use for data feed automation to confirm compatibility.
Upgrade your security: public key authentication
While we continue to support traditional password authentication, we also support Public Key Authentication and is highly recommended for all users.
Why choose Public Key over Passwords?
- Brute-Force Immunity: Unlike passwords, which can be guessed or "brute-forced" by automated bots, SSH keys are cryptographically impossible to crack.
- No Plain-Text Risks: You no longer need to store sensitive passwords in automated scripts or configuration files.
- Two-Factor Protection: By using a "Key + Passphrase," you benefit from two-factor security: something you have (the key file) and something you know (the passphrase).
How to get started with Keys
If you would like to move away from passwords and upgrade to Public Key Authentication, view How to use SFTP Public Key Authentication.
Summary of Next Steps
- Review your logs: If your connection currently uses ssh-rsa or ssh-dss, you must update your software within the next 6 months.
- Test your connection: Mark the Brownout dates on your calendar to ensure your automated tasks continue to run.
- Consider the switch: Reach out to our support team if you would like assistance setting up Public Key Authentication for a more secure, password-less experience.