Políticas de seguridad para AWS Transfer Family

Las políticas de seguridad del servidor AWS Transfer Family le permiten limitar el conjunto de algoritmos criptográficos (códigos de autenticación de mensajes (MACs), intercambios de claves (KEXs) y conjuntos de cifrado) asociados a su servidor. Para consultar una lista de los algoritmos criptográficos admitidos, consulte Algoritmos criptográficos. Para obtener una lista de los algoritmos clave admitidos para su uso con las claves del host del servidor y las claves de usuario administradas por el servicio, consulte Algoritmos admitidos para las claves de usuario y del servidor.

nota

Le recomendamos encarecidamente que actualice sus servidores a nuestra política de seguridad más reciente. Nuestra política de seguridad más reciente es la predeterminada. A cualquier cliente que cree un servidor Transfer Family utilizando CloudFormation y aceptando la política de seguridad predeterminada se le asignará automáticamente la última política. Si le preocupa la compatibilidad de los clientes, indique afirmativamente qué política de seguridad desea utilizar al crear o actualizar un servidor en lugar de utilizar la política predeterminada, que está sujeta a cambios.

Para cambiar la política de seguridad de un servidor, consulteEditar la política de seguridad.

Para obtener más información sobre la seguridad de Transfer Family, consulta la entrada del blog Cómo Transfer Family puede ayudarte a crear una solución de transferencia de archivos gestionada segura y compatible.

nota

TransferSecurityPolicy-2024-01es la política de seguridad predeterminada que se adjunta al servidor al crear un servidor mediante la consolaAPI, oCLI.

Algoritmos criptográficos

Para las claves de host, admitimos los siguientes algoritmos:

• rsa-sha-256

• rsa-sha-512

• ecdsa-sha2-nistp256

• ecdsa-sha2-nistp384

• ecdsa-sha2-nistp512

• ssh-ed25519

Además, las políticas de seguridad de 2018 y 2020 lo permitenssh-rsa.

nota

Es importante entender la diferencia entre el tipo de RSA clave (que es siempre) ssh-rsa y el algoritmo de RSA clave principal, que puede ser cualquiera de los algoritmos compatibles.

La siguiente es una lista de los algoritmos criptográficos admitidos con cada política de seguridad.

nota

En la tabla y las políticas siguientes, observe el siguiente uso de los tipos de algoritmos.

• SFTPlos servidores solo utilizan algoritmos en las SshMacssecciones SshCiphersSshKexs, y.

• FTPSlos servidores solo utilizan los algoritmos de la TlsCipherssección.

• FTPlos servidores, dado que no utilizan cifrado, no utilizan ninguno de estos algoritmos.

Política de seguridad	2024-01	2023-05	2022-03	2020-06	FIPS-2024-01	FIPS-2023-05	FIPS-2020-06	2018-11
SshCiphers
aes128-ctr	♦			♦	♦		♦	♦
[e-mail]	♦	♦	♦	♦	♦	♦	♦	♦
aes192-ctr	♦	♦	♦	♦	♦	♦	♦	♦
aes256-ctr	♦	♦	♦	♦	♦	♦	♦	♦
[e-mail]	♦	♦	♦	♦	♦	♦	♦	♦
[e-mail]				♦				♦
SshKexs
curva 25519-sha256	♦	♦	♦					♦
[e-mail]	♦	♦	♦					♦
diffie-hellman-group14-sha1								♦
diffie-hellman-group14-sha256				♦			♦	♦
diffie-hellman-group16-sha512	♦	♦	♦	♦	♦	♦	♦	♦
diffie-hellman-group18-sha512	♦	♦	♦	♦	♦	♦	♦	♦
diffie-hellman-group-exchange-sha256		♦	♦	♦		♦	♦	♦
[e-mail]	♦				♦
[e-mail]	♦				♦
[e-mail]	♦				♦
ecdh-sha2-nistp256	♦			♦	♦		♦	♦
ecdh-sha2-nistp384	♦			♦	♦		♦	♦
ecdh-sha2-nistp521	♦			♦	♦		♦	♦
[e-mail]	♦
SshMacs
hmac-sha1								♦
[e-mail]								♦
hmac-sha2-256			♦	♦			♦	♦
[e-mail]	♦	♦	♦	♦	♦	♦	♦	♦
hmac-sha2-512			♦	♦			♦	♦
[e-mail]	♦	♦	♦	♦	♦	♦	♦	♦
[e-mail]				♦				♦
[e-mail]				♦				♦
[e-mail]								♦
[e-mail]								♦
TlsCiphers
TLS_ ECDHE _ ECDSA _ WITH AES CBC _128_ _ SHA256	♦	♦	♦	♦	♦	♦	♦	♦
TLS_ _ _ ECDHE _ ECDSA _128_ WITH _ AES GCM SHA256	♦	♦	♦	♦	♦	♦	♦	♦
TLS_ _ _ ECDHE _ ECDSA _256_ WITH _ AES CBC SHA384	♦	♦	♦	♦	♦	♦	♦	♦
TLS_ _ _ ECDHE _ ECDSA _256_ WITH _ AES GCM SHA384	♦	♦	♦	♦	♦	♦	♦	♦
TLS_ _ _ ECDHE _ RSA _128_ WITH _ AES CBC SHA256	♦	♦	♦	♦	♦	♦	♦	♦
TLS_ _ _ ECDHE _ RSA _128_ WITH _ AES GCM SHA256	♦	♦	♦	♦	♦	♦	♦	♦
TLS_ _ _ ECDHE _ RSA _256_ WITH _ AES CBC SHA384	♦	♦	♦	♦	♦	♦	♦	♦
TLS_ _ _ ECDHE _ RSA _256_ WITH _ AES GCM SHA384	♦	♦	♦	♦	♦	♦	♦	♦
TLS_ _ _ RSA _128_ WITH _ AES CBC SHA256								♦
TLS_ _ _ RSA _256_ WITH _ AES CBC SHA256								♦

TransferSecurityPolicy-2024-01

A continuación se muestra la política de seguridad TransferSecurityPolicy -2024-01.

{
    "SecurityPolicy": {
        "Fips": false,
        "SecurityPolicyName": "TransferSecurityPolicy-2024-01",
        "SshCiphers": [
            "[e-mail]",
            "[e-mail]",
            "aes128-ctr",
            "aes256-ctr",
            "aes192-ctr"
        ],
        "SshKexs": [
            "[e-mail]",
            "[e-mail]",
            "[e-mail]",
            "[e-mail]",
            "ecdh-sha2-nistp256",
            "ecdh-sha2-nistp384",
            "ecdh-sha2-nistp521",
            "curve25519-sha256",
            "[e-mail]",
            "diffie-hellman-group18-sha512",
            "diffie-hellman-group16-sha512",
            "diffie-hellman-group-exchange-sha256"
        ],
        "SshMacs": [
            "[e-mail]",
            "[e-mail]"
        ],
        "TlsCiphers": [
            "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
            "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
            "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
            "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
            "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
            "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
            "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
            "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"
        ]
    }
}

TransferSecurityPolicy-2023-05

A continuación se muestra la política de seguridad de TransferSecurityPolicy -2023-05.

{
    "SecurityPolicy": {
        "Fips": false,
        "SecurityPolicyName": "TransferSecurityPolicy-2023-05",
        "SshCiphers": [
            "[e-mail]",
            "[e-mail]",
            "aes256-ctr",
            "aes192-ctr"
        ],
        "SshKexs": [
            "curve25519-sha256",
            "[e-mail]",
            "diffie-hellman-group16-sha512",
            "diffie-hellman-group18-sha512",
            "diffie-hellman-group-exchange-sha256"
        ],
        "SshMacs": [
            "[e-mail]",
            "[e-mail]"
        ],
        "TlsCiphers": [
            "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
            "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
            "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
            "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
            "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
            "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
            "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
            "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"
        ]
    }
}

TransferSecurityPolicy-2022-03

A continuación se muestra la política de seguridad del TransferSecurityPolicy -2022-03.

{
  "SecurityPolicy": {
    "Fips": false,
    "SecurityPolicyName": "TransferSecurityPolicy-2022-03",
    "SshCiphers": [
      "[e-mail]",
      "[e-mail]",
      "aes256-ctr",
      "aes192-ctr"
    ],
    "SshKexs": [
      "curve25519-sha256",
      "[e-mail]",
      "diffie-hellman-group16-sha512",
      "diffie-hellman-group18-sha512",
      "diffie-hellman-group-exchange-sha256"
    ],
    "SshMacs": [
      "[e-mail]",
      "[e-mail]",
      "hmac-sha2-512",
      "hmac-sha2-256"
    ],
    "TlsCiphers": [
      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", 
      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", 
      "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", 
      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", 
      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", 
      "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", 
      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"
    ]
  }
}

TransferSecurityPolicy-2020-06

A continuación se muestra la política de seguridad de la versión TransferSecurityPolicy -2020-06.

{
  "SecurityPolicy": {
    "Fips": false,
    "SecurityPolicyName": "TransferSecurityPolicy-2020-06",
    "SshCiphers": [
      "[e-mail]",
      "aes128-ctr",
      "aes192-ctr",
      "aes256-ctr",
      "[e-mail]",
      "[e-mail]"
    ],
    "SshKexs": [
      "ecdh-sha2-nistp256",
      "ecdh-sha2-nistp384",
      "ecdh-sha2-nistp521",
      "diffie-hellman-group-exchange-sha256",
      "diffie-hellman-group16-sha512",
      "diffie-hellman-group18-sha512",
      "diffie-hellman-group14-sha256"
    ],
    "SshMacs": [
      "[e-mail]",
      "[e-mail]",
      "[e-mail]",
      "[e-mail]",
      "hmac-sha2-256",
      "hmac-sha2-512"
    ],
    "TlsCiphers": [
      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
      "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
      "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"
    ]
  }
}

TransferSecurityPolicy-2018-11

A continuación se muestra la política de seguridad del modelo TransferSecurityPolicy -2018-11.

{
  "SecurityPolicy": {
    "Fips": false,
    "SecurityPolicyName": "TransferSecurityPolicy-2018-11",
    "SshCiphers": [
      "[e-mail]",
      "aes128-ctr",
      "aes192-ctr",
      "aes256-ctr",
      "[e-mail]",
      "[e-mail]"
    ],
    "SshKexs": [
      "curve25519-sha256",
      "[e-mail]",
      "ecdh-sha2-nistp256",
      "ecdh-sha2-nistp384",
      "ecdh-sha2-nistp521",
      "diffie-hellman-group-exchange-sha256",
      "diffie-hellman-group16-sha512",
      "diffie-hellman-group18-sha512",
      "diffie-hellman-group14-sha256",
      "diffie-hellman-group14-sha1"
    ],
    "SshMacs": [
      "[e-mail]",
      "[e-mail]",
      "[e-mail]",
      "[e-mail]",
      "[e-mail]",
      "[e-mail]",
      "[e-mail]",
      "hmac-sha2-256",
      "hmac-sha2-512",
      "hmac-sha1"
    ],
    "TlsCiphers": [
      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
      "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
      "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
      "TLS_RSA_WITH_AES_128_CBC_SHA256",
      "TLS_RSA_WITH_AES_256_CBC_SHA256"
    ]
  }
}

TransferSecurityPolicy- -2024-01 FIPS

A continuación se muestra la política de seguridad del TransferSecurityPolicy - FIPS -2024-01.

nota

El punto final del FIPS servicio y la política de seguridad TransferSecurityPolicy - FIPS -2024-01 solo están disponibles en algunas regiones. AWS Para obtener más información, consulte Puntos de conexión y cuotas de AWS Transfer Family en la Referencia general de AWS.

{
    "SecurityPolicy": {
        "Fips": true,
        "SecurityPolicyName": "TransferSecurityPolicy-FIPS-2024-01",
        "SshCiphers": [
            "[e-mail]",
            "[e-mail]",
            "aes128-ctr",
            "aes256-ctr",
            "aes192-ctr"
        ],
        "SshKexs": [
            "[e-mail]",
            "[e-mail]",
            "[e-mail]",
            "ecdh-sha2-nistp256",
            "ecdh-sha2-nistp384",
            "ecdh-sha2-nistp521",
            "diffie-hellman-group18-sha512",
            "diffie-hellman-group16-sha512",
            "diffie-hellman-group-exchange-sha256"
        ],
        "SshMacs": [
            "[e-mail]",
            "[e-mail]"
        ],
        "TlsCiphers": [
            "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
            "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
            "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
            "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
            "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
            "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
            "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
            "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"
        ]
    }
}

TransferSecurityPolicy- -2023-05 FIPS

Los detalles FIPS de la certificación AWS Transfer Family se encuentran en https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules/search/all

A continuación se muestra la política TransferSecurityPolicy de seguridad del FIPS -2023-05.

nota

El punto final del FIPS servicio y la política de seguridad TransferSecurityPolicy - FIPS -2023-05 solo están disponibles en algunas regiones. AWS Para obtener más información, consulte Puntos de conexión y cuotas de AWS Transfer Family en la Referencia general de AWS.

{
    "SecurityPolicy": {
        "Fips": true,
        "SecurityPolicyName": "TransferSecurityPolicy-FIPS-2023-05",
        "SshCiphers": [
            "[e-mail]",
            "[e-mail]",
            "aes256-ctr",
            "aes192-ctr"
        ],
        "SshKexs": [
            "diffie-hellman-group16-sha512",
            "diffie-hellman-group18-sha512",
            "diffie-hellman-group-exchange-sha256"
        ],
        "SshMacs": [
            "[e-mail]",
            "[e-mail]"
        ],
        "TlsCiphers": [
            "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
            "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
            "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
            "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
            "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
            "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
            "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
            "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"
        ]
    }
}

TransferSecurityPolicy- -2020-06 FIPS

Los detalles FIPS de la certificación AWS Transfer Family se encuentran en https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules/search/all

A continuación se muestra la política de TransferSecurityPolicy seguridad del - FIPS -2020-06.

nota

El punto final del FIPS servicio y la política de seguridad TransferSecurityPolicy - FIPS -2020-06 solo están disponibles en algunas regiones. AWS Para obtener más información, consulte Puntos de conexión y cuotas de AWS Transfer Family en la Referencia general de AWS.

{
  "SecurityPolicy": {
    "Fips": true,
    "SecurityPolicyName": "TransferSecurityPolicy-FIPS-2020-06",
    "SshCiphers": [
      "aes128-ctr",
      "aes192-ctr",
      "aes256-ctr",
      "[e-mail]",
      "[e-mail]"
    ],
    "SshKexs": [
      "ecdh-sha2-nistp256",
      "ecdh-sha2-nistp384",
      "ecdh-sha2-nistp521",
      "diffie-hellman-group-exchange-sha256",
      "diffie-hellman-group16-sha512",
      "diffie-hellman-group18-sha512",
      "diffie-hellman-group14-sha256"
    ],
    "SshMacs": [
      "[e-mail]",
      "[e-mail]",
      "hmac-sha2-256",
      "hmac-sha2-512"
    ],
    "TlsCiphers": [
      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
      "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
      "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"
    ]
  }
}

Políticas de seguridad poscuánticas

En esta tabla, se enumeran los algoritmos de las políticas de seguridad poscuántica de Transfer Family. Estas políticas se describen en detalle en Uso del intercambio de claves híbrido poscuántico con AWS Transfer Family.

La lista de políticas sigue la tabla.

Política de seguridad	TransferSecurityPolicy-PQ- -Experimental - 2023-04 SSH	TransferSecurityPolicy-PQ- - SSH -Experimental-2023-04 FIPS
SSH ciphers
aes128-ctr		♦
[e-mail]	♦	♦
aes192-ctr	♦	♦
aes256-ctr	♦	♦
[e-mail]	♦	♦
KEXs
[e-mail]	♦	♦
[e-mail]	♦	♦
[e-mail]	♦	♦
[e-mail]	♦
diffie-hellman-group14-sha256		♦
diffie-hellman-group16-sha512	♦	♦
diffie-hellman-group18-sha512	♦	♦
ecdh-sha2-nistp384		♦
ecdh-sha2-nistp521		♦
diffie-hellman-group-exchange-sha256	♦	♦
ecdh-sha2-nistp256		♦
[e-mail]	♦
curva 25519-sha256	♦
MACs
[e-mail]	♦	♦
hmac-sha2-256	♦	♦
[e-mail]	♦	♦
hmac-sha2-512	♦	♦
TLS ciphers
TLS_ _ _ ECDHE _ ECDSA _128_ WITH _ AES CBC SHA256	♦	♦
TLS_ _ _ ECDHE _ ECDSA _128_ WITH _ AES GCM SHA256	♦	♦
TLS_ _ _ ECDHE _ ECDSA _256_ WITH _ AES CBC SHA384	♦	♦
TLS_ _ _ ECDHE _ ECDSA _256_ WITH _ AES GCM SHA384	♦	♦
TLS_ _ _ ECDHE _ RSA _128_ WITH _ AES CBC SHA256	♦	♦
TLS_ _ _ ECDHE _ RSA _128_ WITH _ AES GCM SHA256	♦	♦
TLS_ _ _ ECDHE _ RSA _256_ WITH _ AES CBC SHA384	♦	♦
TLS_ _ _ ECDHE _ RSA _256_ WITH _ AES GCM SHA384	♦	♦

TransferSecurityPolicy-PQ- -Experimental - 2023-04 SSH

A continuación se muestra la política de seguridad del TransferSecurityPolicy-PQ-SSH-Experimental 2023-04.

{
    "SecurityPolicy": {
        "Fips": false,
        "SecurityPolicyName": "TransferSecurityPolicy-PQ-SSH-Experimental-2023-04",
        "SshCiphers": [
            "[e-mail]",
            "[e-mail]",
            "aes256-ctr",
            "aes192-ctr"
        ],
        "SshKexs": [
            "[e-mail]",
            "[e-mail]",
            "[e-mail]",
            "[e-mail]",
            "curve25519-sha256",
            "[e-mail]",
            "diffie-hellman-group16-sha512",
            "diffie-hellman-group18-sha512",
            "diffie-hellman-group-exchange-sha256"
        ],
        "SshMacs": [
            "[e-mail]",
            "[e-mail]",
            "hmac-sha2-512",
            "hmac-sha2-256"
        ],
        "TlsCiphers": [
            "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
            "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
            "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
            "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
            "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
            "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
            "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
            "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"
        ]
    }
}

TransferSecurityPolicy-PQ- - -Experimental-2023-04 SSH FIPS

A continuación se muestra la política de seguridad de -Experimental-2023-04. TransferSecurityPolicy-PQ-SSH-FIPS

{
    "SecurityPolicy": {
        "Fips": true,
        "SecurityPolicyName": "TransferSecurityPolicy-PQ-SSH-FIPS-Experimental-2023-04",
        "SshCiphers": [
            "[e-mail]",
            "[e-mail]",
            "aes256-ctr",
            "aes192-ctr",
            "aes128-ctr"
        ],
        "SshKexs": [
            "[e-mail]",
            "[e-mail]",
            "[e-mail]",
            "ecdh-sha2-nistp256",
            "ecdh-sha2-nistp384",
            "ecdh-sha2-nistp521",
            "diffie-hellman-group-exchange-sha256",
            "diffie-hellman-group16-sha512",
            "diffie-hellman-group18-sha512",
            "diffie-hellman-group14-sha256"
        ],
        "SshMacs": [
            "[e-mail]",
            "[e-mail]",
            "hmac-sha2-512",
            "hmac-sha2-256"
        ],
        "TlsCiphers": [
            "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
            "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
            "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
            "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
            "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
            "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
            "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
            "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"
        ]
    }
}