IBM Aspera HST Admin Manual page 102

Galois/counter mode (GCM). The GCM mode encrypts data faster and increases transfer speeds
compared to the CFB mode, but the server must support and permit it.
Cipher rules
The encryption cipher that you are allowed to use depends on the server configuration and the
version of the client and server:
• When you request a cipher key that is shorter than the cipher key that is configured on the server,
the transfer is automatically upgraded to the server configuration. For example, when the server
setting is AES-192 and you request AES-128, the server enforces AES-192.
• When the server requires GCM, you must use GCM (requires version 3.9.0 or newer) or the
transfer fails.
• When you request GCM and the server is older than 3.8.1 or explicity requires CFB, the transfer
fails.
• When the server setting is "any", you can use any encryption cipher. The only exception is when
the server is 3.8.1 or older and does not support GCM mode; in this case, you cannot request
GCM mode encryption.
• When the server setting is "none", you must use "none". Transfer requests that specify an
encryption cipher are refused by the server.
Cipher Values
Value Description
Use the GCM or CFB encryption
aes128
mode, depending on the server
aes192
configuration and version (see cipher
aes256
negotiation matrix).
Use the CFB encryption mode.
aes128cfb
aes192cfb
aes256cfb
Use the GCM encryption mode.
aes128gcm
aes192gcm
aes256gcm
Do not encrypt data in transit. Aspera
none
strongly recommends against using
this setting.
Client-Server Cipher Negotiation
The following table shows which encryption mode is used depending on the server and client
versions and settings:
Server, v3.9.0+
AES-XXX-GCM
Client, v3.9.0+ GCM
AES-XXX-GCM
Client, v3.9.0+
server refuses
transfer
AES-XXX-CFB
| ascp: Transferring from the Command Line with Ascp | 102
Support
All client and server versions.
Clients version 3.9.0 and newer, all
server versions.
Clients and servers version 3.9.0 and
newer.
All client and server versions.
Server, v3.9.0+ Server, v3.9.0+
AES-XXX-CFB AES-XXX
server refuses GCM
transfer
CFB CFB
Server, v3.8.1 or
older
AES-XXX
server refuses
transfer
CFB