7.0.9083 #

(build 9083 from 2024-11-12)

Support for .NET 9!

This release adds a new set of binaries targeting .NET 9. It supports all .NET 9 platforms:

• Windows (x64, x86, ARM64)
• Linux (x64, ARM32, ARM64)
• Android (x64, ARM32, ARM64)
• macOS (ARM64, x64)
• iOS/iPadOS/tvOS (ARM64)

R6.17 available as well

For customers who have not yet upgraded to version 7 of Rebex libraries, we published the R6.17 update with important fixes and enhancements. Version R6.x will be supported until November 2025.

Detailed list of changes:

• All: Added binaries targeting ,NET 9 on all supported platforms.
• File Server: Fixed possible double-close of file system item handle in rare circumstances.
• Cryptography: Added workaround for EnvelopedData with unpadded RSA EncryptedKey.
• Cryptography: Added workaround for parsing CMS ASN.1 with redundant zeros at the end.
• Cryptography: Fixed common name validation logic in NativeCertificateEngine and EnhancedCertificateEngine when used stand-alone by custom code.

7.0.9048 #

(build 9048 from 2024-10-08)

Maintenance release

This release bringes several enhancements and resolves some issues.

Detailed list of changes:

• File Server: Added FileServer.​Settings.​SftpMaxSendQueueLength option to make it possible to limit the maximum length of SFTP outgoing packet queue.
• File Server: Fixed handling of zero columns/rows values in pty-req requests.
• File Server: Fixed sequence of SSH_MSG_NEWKEYS / SSH_MSG_EXT_INFO for CBC ciphers.
• SSH: Fixed less common variants of multi-factor authentication.
• SSH: Fixed SshSession.Authenticate(userName, password, privateKey) method that crashed when privateKey was null (since version 7.0).
• Cryptography: Added ValidationOptions.​DisableCertificateDownloads option (only supported on .NET 5 and higher).
• Cryptography: Fixed detection of support for ECDH with brainpool curves on iOS.
• Cryptography: Fixed padding issues in AsymmetricKeyAlgorithm.​GetKeyMaterialDeriver (did not affect Rebex libraries).
• Cryptography: Fixed wrong RSA public key format when saving private keys in new OpenSSH format.
• Cryptography: Improved handling of wrong (negative) serial numbers in X.509 certificates.

7.0.8943 #

(build 8943 from 2024-06-25)

Maintenance release

This is a maintenance release that brings several enhancements and resolves some issues.

R6.16 available as well

For customers who have not yet upgraded to version 7 of Rebex libraries, we published the R6.16 update with important fixes and enhancements. Version R6.x will be supported until November 2025.

Detailed list of changes:

• File Server: Fixed missing Disconnected event call if SSH session fails immediately.
• TLS Core: Fixed certificate selection and curve selection in TLS 1.3.
• TLS Core: Fixed wrong TlsException.Status for some exceptions representing server-side alerts.
• Cryptography: Added support for issuing certificates signed with Ed25519.
• Cryptography: Fixed calculation of subject key identifier in certificate issuer API.
• Cryptography: Fixed rare wrong final calculation of Poly1305 hash when temporary storage for remaining data is bigger than input block size.
• Cryptography: Using AES/GCM instead of AES/CBC for new OpenSSH key format encryption.

7.0.8865 #

(build 8865 from 2024-04-08)

Maintenance release

This is a maintenance release that brings several enhancements and resolves some issues.

Detailed list of changes:

• File System: Improved reporting of some I/O errors in virtual file systems.
• SSH: SshPublicKey.LoadPublicKeys reads comments and does not fail on empty files.
• TLS Core: Added option to disable ClientHello padding. Added option to enable legacy SCSV mode.
• TLS Core: Fixed potential repeated clean-up of TLS 1.3 extensions that might cause strange exceptions in the following TLS connection.
• Cryptography: Added support for loading private keys in new OpenSSH key format encrypted using AES/GCM or ChaCha20/Poly1305.

7.0.8816 #

(build 8816 from 2024-02-19)

SSH enhancements

Client-side SSH now supports a combination of password and keyboard-interactive authentication and contains other improvements as well. For example, Session.Cipher.StrictKeyExchange property on Sftp or Ssh objects can be used to determine whether strict SSH key exchange (mitigating the 'Terrapin' weakness) has been used.

R6.15 available as well

For customers who have not yet upgraded to version 7 of Rebex libraries, we published the R6.15 update with important fixes and enhancements. Version R6.x will be supported until November 2025.

Detailed list of changes:

• File Server: Added logging of SSH ciphers supported by the client on mismatch.
• File Server: Fixed handling of client's SSH_MSG_EXT_INFO.
• File System: Added an instructional exception message when VFS node name contains prohibited characters.
• File System: Fixed unexpected exception propagation in directory creation.
• SSH: Added SshCipher.StrictKeyExchange and SshServerInfo.​SupportsStrictKeyExchange properties.
• SSH: Added SshPrivateKey.​CreateFrom(PrivateKeyInfo) method.
• SSH: Added support for a combination of password and keyboard-interactive authentication.
• SSH: Improved SSH session and channel lifecycle logging.
• SSH: Using lower local SSH channel numbers for better log readability.
• TLS Core: Fixed invalid TLS 1.3 behavior for rare Poll/Receive call sequence on TlsSocket.
• TLS Core: Fixed possible deadlock in Receive or Poll methods when additional incomplete packet is received after close_notify in TLS 1.2 or earlier.
• Cryptography: Added low-level API for loading/saving PrivateKeyInfo with byte[] passwords.
• Cryptography: Added ObjectIdentifier.Encode method.
• Cryptography: Added support for loading PKCS #8 private keys with legacy RC4 algorithm.
• Cryptography: Added UseDer property to SignedData and EnvelopedData classes.
• Cryptography: PrivateKeyInfo.Save now uses SHA-2 instead of SHA-1 in PKCS #8 format with PBKDF2 derivation.
• Cryptography: Reduced memory footprint of CNG API interop layer.

7.0.8755 #

(build 8755 from 2023-12-20)

Strict key exchange in SSH

Rebex SSH library now implements OpenSSH's strict KEX protocol extension that addresses a weakness in the SSH protocol that makes some OpenSSH ciphers vulnerable to Terrapin attack (CVE-2023-48795).

The attack is only possible when one of the following OpenSSH ciphers is in use:

• chacha20-poly1305@openssh.com
• hmac-sha2-256-etm@openssh.com
• hmac-sha2-512-etm@openssh.com

Fortunately, in practice, the actual impact of the weakness on most SSH implementation seems to be negligible. No version of Rebex SSH relies on RFC 8308 extension negotiation mechanism yet, so this weakness can only be used by an attacker to disrupt authentication, causing the SSH session to fail.

Strict key exchange extension is enabled by default. It can be disabled using Settings.SshParameters.UseStrictKeyExchange option. Please note that this extension only resolves the weakness if both the client and server SSH implementation support it. When connecting a vulnerable client to an updated server (or vice versa), Terrapin attack is still possible.

Improved Native AOT compatibility

This update improves compatibility with .NET 8's Native AOT deployment model, which makes it possible to compile applications to native code ahead-of-time (AOT). Most common features should already work in Native AOT mode.

Detailed list of changes:

• All: Improved compatibility with Native AOT in .NET 8.
• File Server: Added support for strict key exchange extension (thwarts the so-called 'Terrapin attack').
• File Server: Allowed dates outside 1970-2999 range in SFTP v4 (or higher).
• SSH: Added support for PKCS #8 format to SshPublicKey constructor.
• SSH: Added support for strict key exchange extension (thwarts the so-called 'Terrapin attack').
• Common: Optimized memory usage of miscellaneous methods.

7.0.8720 #

(build 8720 from 2023-11-15)

Support for .NET 8!

This release adds a new set of binaries targeting .NET 8. It supports all .NET 8 platforms:

• Windows (x64, x86, ARM64)
• Linux (x64, ARM32, ARM64)
• macOS (x64)
• Android
• iOS/tvOS

Detailed list of changes:

• All: Added a new set of binaries targeting .NET 8.0.
• SSH: Added SshParameters.ChannelCloseTimeout property.
• Cryptography: Fixed behavior of certificate issuer API when no CRLs have been specified.

7.0.8657 #

(build 8657 from 2023-09-13)

Maintenance release

This is a maintenance release that fixes minor issues.

Detailed list of changes:

• Networking: Fixed handling of IPv6 addresses in square brackets.
• SSH: Fixed behavior of Certificate flag in SshParameters.HostKeyAlgorithms.

7.0.8581 #

(build 8581 from 2023-06-29)

First 7.0.* release!

This is the first release of 7.0.* series. It no longer uses the 'Rx.y' naming scheme, which was somewhat confusing.

The R6.x series will be supported until November 2025 and will receive fixes and security updates.

Support for secp256k1 curve in SSH

Rebex SSH client and server libraries now support ECDH and ECDSA ciphers with secp256k1 curve (ecdh-sha2-1.3.132.0.10 and ecdsa-sha2-1.3.132.0.10).

Support for Telnet Environment Option

Added support for Telnet Environment Option (RFC 1572).

AesGcm and ChaChaPoly1305 moved to Rebex.Security

AesGcm and ChaChaPoly1305 classes were moved from Rebex.Common assembly to Rebex.Security. If you are using these classes and don't have a Rebex Total Pack or Rebex Security license, please let us know.

Detailed list of changes:

• File Server: Added custom Context property to ConnectingEventArgs, PreAuthenticationEventArgs and AuthenticationEventArgs.
• File Server: Added FileServer.​Settings.​MaxAuthenticationDuration option.
• File Server: Changed default shell character encoding to UTF-8.
• File Server: Improved client public key authentication process.
• File Server: Optimized 'Move' operation in LocalFileSystemProvider.
• File System: Added 'NodePath.IsBackslashInFileNameAllowed' property. Setting it to true allows '\' character in VFS node name.
• Networking: Added SslSettings.SslRenegotiationMode option.
• Networking: No longer sending default domain in SSPI requests by defalt. Added SslSettings.UseDefaultDomain property.
• SSH: Added SshPublicKey.Parse method and a new overload for SshPublicKey.LoadPublicKeys.
• SSH: Added support for ECDH and ECDSA with secp256k1 curve ('ecdh-sha2-1.3.132.0.10' and 'ecdsa-sha2-1.3.132.0.10').
• SSH: Added support for SSH agents (OpenSSH agent and Pageant).
• SSH: Preferring ChaCha20/Poly1305 on platforms with HW intrinsics support.
• TLS Core: Added public API for TLS 1.3 and TLS 1.2 signature algorithms.
• TLS Core: Added public API for TLS 1.3 named groups and pre-shared key exchange modes configuration.
• TLS Core: Added support for Ed25519 in TLS 1.2 (already supported in TLS 1.3).
• TLS Core: Added support for modular Diffie-Hellman (FFDHE) in TLS 1.3.
• TLS Core: ClientHello is padded to 512 bytes to work around strange bugs in the erroneous TLS implementation on some servers.
• TLS Core: Disable client-initiated TLS renegotiation by default.
• TLS Core: Enabled ChaCha20/Poly1305 ciphers by default on .NET Core 3.1 / .NET 5 or higher.
• TLS Core: Changed the default order of cipher suites in ClientHello to more closely align with the best practices of the industry.
• TLS Core: In TLS 1.2, support for Renegotiation Indication Extension is annonced using renegotiation_info extension.
• TLS Core: The default selection of TLS 1.2 elliptic curves has been altered to more closely align with the best practices of the industry.
• TLS Core: TlsServerSocket now honors TlsOptions.DoNotCacheSessions flag when TLS 1.3 is negotiated.
• TLS Core: Updated default TLS 1.2 cipher preference order. Disabled 3DES by default. Added TlsCipherSuite.Common value.
• Cryptography: Added API for CRL distribution endpoints with multiple CRL entries.
• Cryptography: Added Certificate.Bind methods.
• Cryptography: Added CertificateStoreName.WebHosting enum value.
• Cryptography: Added CertificateStoreOpenFlags and corresponding CertificateStore constructors.
• Cryptography: AesGcm and ChaChaPoly1305 classes moved from Rebex.Common assembly to Rebex.Security.
• Cryptography: Certificate.Extensions collection is now read-only.
• Cryptography: Deprecated EncryptValue/DecryptValue methods in RSAManaged class.
• Cryptography: Fixed visibility of CertificateException legacy serialization constructor.
• Cryptography: Improved loading of Y-less legacy DSA keys in FIPS-only mode on .NET 6/7 in Windows.
• Common: Optimized internal Task.Run methods on old platforms.
• Common: Optimized internal WhenAll/WhenAny Task combinators on old platforms.

R6.14 #

(version 6.0.8580 from 2023-06-28)

Maintenance release

This is a maintenance release that brings several enhancements and resolves some issues.

What next for R6.x?

Version R6.x of Rebex libraries will be supported until November 2025 and will receive fixes and security updates. See R6.x release history for more information.

Detailed list of changes:

• All: Fixed problems in finalizer logic.
• SSH: Fixed missing end-of-lines in new OpenSSH key format.
• Cryptography: Fixed support for ECDSA private key formats with optional public key.

R6.13 #

(version 6.0.8558 from 2023-06-06)

Maintenance release

This is a maintenance release that brings several enhancements and resolves some issues.

Detailed list of changes:

• File Server: Fixed filename handling in SCP's non-directory upload mode.
• File Server: Fixed handling of datetimes on non-Windows file systems.
• Networking: Added support for IPv6 addresses to SOCKS5 proxy (client-side).
• Networking: Added workaround for systems where System.​Net.​Sockets.​Socket.​RemoteEndPoint does not work properly.
• Networking: Fixed formatting of IPv6 addresses for HTTP CONNECT proxies.
• Networking: Using 'Proxy-Connection' header instead of 'Connection' with HTTP CONNECT proxies.
• TLS Core: Disabled workaround for DHE padding bug in old versions of MS Schannel.
• TLS Core: Fixed server-side TLS curve selection on end-of-life platforms.
• Cryptography: Fixed lifecycle of AsymmetricKeyAlgorithm based on RSA CSP.
• Cryptography: Improved support for SignatureHashAlgorithm.MD5SHA1 in .NET 5 and higher in FIPS-only mode.

R6.12 #

(version 6.0.8509 from 2023-04-18)

Maintenance release

This is a maintenance release that brings several enhancements and resolves some issues.

Detailed list of changes:

• File Server: Fixed parsing of "\$" sequences in SSH commands.
• File System: Exists methods/properties in Rebex.IO VFS API return 'false' (like System.IO) instead of raising an exception.
• File System: Improved recursion breaker.
• File System: Rebex.IO VFS API raises InvalidOperationException when the underlying VFS provider is not registered as a VDriveInfo object.
• File System: Rebex.IO VFS API raises NotSupportedException when the format of the specified path is invalid.
• SSH: Added workaround for an issue in 'srt SSH Server' that makes it reject RSA/SHA-2 public key authentication attempts.
• SSH: Fixed handling of SSH2 PUBLIC KEY quotation marks in SshPublicKey.
• SSH: Fixed handling of user name when performing single sign-on in .NET Core and .NET 5/6/7.
• TLS Core: Fixed client-side TLS cipher suite check and server-side TLS cipher selection.
• TLS Core: Fixed checking of selected elliptic curves.
• TLS Core: Fixed memory leak in server-side TLS session cache.
• Common: Fixed rare race condition in scheduled action infrastructure.

R6.11 #

(version 6.0.8432 from 2023-01-31)

Maintenance release

This is a maintenance release that brings several enhancements and resolves some issues.

Detailed list of changes:

• File Server: Added workaround for libssh2's broken string value encoding (in SCP or possibly elsewhere).
• File System: Fixed potential memory leak when a VFS provider is disposed in an unexpected thread.
• Networking: Comment is no longer ignored when loading SSH2 public key into SshPublicKey.
• SSH: Fixed occasional StackOverflowException in SSH tunnel code (thrown when a large batch of consecutive asynchronous IO operations completes synchronously).
• TLS Core: Fixed handling of missing close_notify message in TLS 1.2 or earlier.
• Cryptography: Fixed CRL retrieval for certificate with multiple CRL distribution endpoints.
• Common: Fixed potential premature release of an unmanaged buffer in SSPI interop code.
• Common: Improved compatibility with Windows 2000.

R6.10 #

(version 6.0.8372 from 2022-12-02)

Maintenance release

This is a maintenance release that brings several enhancements and resolves some issues.

Detailed list of changes:

• SSH: Added workaround for an issue in Azure Blob Storage SFTP that makes it reject RSA/SHA-2 public key authentication attempts.
• TLS Core: Fixed TlsParameter.AcceptableAuthorities handling (can specify an empty list).
• Cryptography: Added workaround for broken X25519 implementation in early versions of Windows 10 (version 1507 and 1511).
• Common: Fixed Windows Extended Protection in 64-bit Windows applications.

R6.9 #

(version 6.0.8348 from 2022-11-08)

Support for .NET 7!

This release adds a new set of binaries targeting .NET 7. It supports all .NET 7 platforms:

• Windows (x64, x86, ARM64)
• Linux (x64, ARM32, ARM64)
• macOS (x64)
• Android
• iOS/tvOS

Detailed list of changes:

• All: Added a new set of binaries targeting .NET 7.
• Cryptography: Fixed SHA-2 support on pre-SP3 versions of Windows XP.

R6.8 #

(version 6.0.8334 from 2022-10-25)

SSE2 implementation of ChaCha20

Last year, we introduced a very fast AVX2 implementation of ChaCha20 encryption cipher. However, some older or mobile CPUs lack AVX2 support, and this is where the new SSE2 implementation will become useful and improved performance of ChaCha20/Poly1305 in TLS and SSH. (Just like AVX2, the new SSE2 implementation is only available on .NET Core 3.1 and .NET 5/6.)

Detailed list of changes:

• Networking: Improved timeout handling during TCP connect.
• TLS Core: Fixed handling of incomplete TLS 1.3 records.
• TLS Core: Further optimized TLS 1.3 core.
• TLS Core: Improved handling of invalid TLS 1.3 session tickets (PSKs).
• TLS Core: Reduced memory footprint and CPU usage of TLS 1.3.
• Cryptography: Added SSE2 implementation of ChaCha20 for .NET 5.0 or higher.

R6.7 #

(version 6.0.8314 from 2022-10-05)

Fixed code signing (broken by DigiCert)

From September 14^th to September 22^nd, 2022, DigiCert's timestamping authority mistakenly issued a TSA certificate with a validity period of only one year. Unfortunately, this mistake means that code-signed Rebex assemblies from R6.6 release will no longer pass validation after February 28^th, 2024.

Therefore, Rebex customers should upgrade from R6.6 as soon as possible to take advantage of the new TSA certificate's full 11-year validity period.

Detailed list of changes:

• All: This release is properly code-signed again. TSA certificate validity was too short in R6.6 due to DigiCert's mistake.
• SSH: Added workaround for SSH servers that claim to prefer 'ssh-rsa' for client public key authentication.
• Cryptography: Added Rebex.Common.Validator assembly.

R6.6 #

(version 6.0.8295 from 2022-09-16)

New constructor for SshPrivateKey/SshPublicKey

SshPrivateKey and SshPublicKey feature a new constructor that accepts an instance of AsymmetricKeyAlgorithm.

Detailed list of changes:

• File Server: Fixed handling of read-only items in raw directory listings.
• File Server: Improved error reporting when using .NET-based file system.
• SSH: Added new constructors to SshPrivateKey/SshPublicKey classes that accept AsymmetricKeyAlgorithm.
• SSH: Added support for ECDSA to SshPrivateKey(AsymmetricAlgorithm) constructor (on .NET Core 3.1 or higher).
• SSH: Fixed rare NullReferenceException when closing an SshSession.
• TLS Core: Added support for Windows Extended Protection (only available on Windows).
• Cryptography: Added GetPrivateKeyAlgorithm/​GetPublicKeyAlgorithm methods to Certificate class.

R6.5 #

(version 6.0.8232 from 2022-07-15)

Support for more SSH extensions

Added support for server-sig-algs SSH extension (RFC 8332) and for SSH extension negotiation (RFC 8308).

Detailed list of changes:

• File Server: Added support for SSH extension negotiation (RFC 8308).
• SSH: Added support for 'server-sig-algs' SSH extension (RFC 8332).
• SSH: Improved logging of 'partial success' authentication responses.
• TLS Core: Added support for TLS extended master secret extension (RFC 7627).
• TLS Core: Fixed handling of NoRenegotiation alert.
• TLS Core: Fixed rare race condition when closing TLS 1.2 socket.
• Common: Improved internal asynchronous infrastructure for old platforms.

R6.4 #

(version 6.0.8181 from 2022-05-25)

Support for .NET 6.0 on Android and iOS

Support for mobile platforms in .NET 6.0 has finally arrived, slightly masquaraded as .NET MAUI. Rebex libraries now support these new platforms as well.

Optimized AEAD ciphers in SSH

ChaCha20/Poly1305 and AES/GCM ciphers have been slightly optimized on all platforms.

Detailed list of changes:

• All: Added support for .NET 6.0 on Android.
• All: Added support for .NET 6.0 on iOS.
• File Server: Throwing IOException in custom command API when attempt is made to send data over a shutdown SSH channel.
• File System: Optimized memory consumption of internal thread-local variables.
• SSH: Fixed behavior of TryPasswordFirst option with servers that support 'publickey' and 'keyboard-interactive' but not 'password'.
• SSH: Optimized AEAD ciphers in SSH.
• TLS Core: Optimized AEAD ciphers in TLS.
• TLS Core: Optimized CPU usage in TLS 1.3 data flow.
• TLS Core: Optimized scenario when the remote party requires TLS 1.2 (or lower TLS version) and TLS 1.3 is enabled.
• TLS Core: Optimized TLS 1.3 key derivation functions.
• Cryptography: Added support for NTLM plugin for non-Windows platforms.
• Cryptography: Added workaround for buggy RSACryptoServiceProvider in .NET 6.0 on Android.
• Cryptography: Enhanced workarounds for slightly misbehaved certificate validator in .NET 6.0 on Android.
• Cryptography: Fixed exporting of DSA keys on Windows XP SP3.
• Cryptography: Optimized ChaCha20Poly1305 internals.
• Cryptography: Optimized internal AEAD interfaces.
• Cryptography: Working around RSA private key access issue in .NET 6.0 on Android.
• Common: Improved inner exception rethrow logic on .NET Framework 3.5/4.0.
• Common: Optimized internal data buffer methods.

R6.3 #

(version 6.0.8123 from 2022-03-28)

Maintenance release

This is a maintenance release that brings several enhancements and resolves some issues.

Detailed list of changes:

• File Server: Fixed FileServer.​Settings.​SendBufferSize/​ReceiveBufferSize on modern platforms.
• File Server: Fixed inconsistency between NodePath.GetHashCode and NodePath.Equals methods caused by the case-insensitive logic in GetHashCode method.
• Networking: Added ProxySocket.Bind(Socket) protected method to allow more customization.
• SSH: Improved workaround for very old versions of Bitvise server that don't properly handle SSH channel closing.
• TLS Core: Added TlsSocket.CloseAsync method (alias for DisposeAsync method).
• TLS Core: Fixed occasional (rare) premature termination of the TLS connection when a remote party does not support TLS 1.3.
• TLS Core: Improved protocol mismatch detection.
• TLS Core: Optimized asynchronous Send/Receive operation in TLS 1.3.
• Cryptography: Improved Poly1305 internals.
• Cryptography: Slightly optimized encrypt/decrypt operations in symmetric branch of the CNG/BCrypt interop layer.
• Cryptography: Small optimization in ARM (Advanced NEON SIMD) implementation of ChaCha20.
• Common: Fixed rare premature finalization of a buffer in SSPI interop that might lead to an AccessViolationException.
• Common: Improved internal asynchronous infrastructure.

R6.2 #

(version 6.0.8060 from 2022-01-24)

Maintenance release

This is a maintenance release that resolves several issues.

Detailed list of changes:

• File System: Fixed handling of FileSystemException in the iterator from VFS provider's GetChildren method.
• Networking: Fixed timeout handling during name resolution.
• TLS Core: Fixed handling of TLS 1.3 signature_algorithms_cert extension.
• TLS Core: Optimized temporary object usage in TLS 1.3 Send/Receive metods.
• Cryptography: Fixed releasing of CNG handles in AES/GCM interop (issue only present in R6.1 on Windows).

R6.1 #

(version 6.0.8044 from 2022-01-08)

Maintenance release

This is a maintenance release that brings several enhancements and resolves some issues.

Detailed list of changes:

• All: Fixed compatibility of Rebex binaries for .NET Framework 4.0 with ASP.NET 4.5 or higher.
• File Server: Fixed possible NullReferenceException in ServerSession.SendMessage method.
• File System: Added FileSystemNotifier.Provider property.
• File System: Fixed Path property in nodes created under mounted directories.
• TLS Core: Optimized receive operation in TLS 1.3.
• TLS Core: Slight optimizations in TLS 1.3 on modern platforms.
• Cryptography: Caching of CNG algorithm provider handles.
• Cryptography: Fixed Certificate.​GetSignatureHashAlgorithm() for certificates signed by Ed25519 authorities.
• Cryptography: Fixed unmanaged resource leak in CertificateStore.
• Cryptography: Optimized symmetric branch of Windows CNG (BCrypt) interop layer.

R6.0 #

(version 6.0.8000 from 2021-11-25)

Support for .NET 6.0!

This release adds a new set of binaries targeting .NET 6.0. It supports all .NET 6.0 platforms:

• Windows (x64, x86, ARM64)
• Linux (x64, ARM32, ARM64)
• macOS (x64)

Please note that support for Android and iOS/tvOS in .NET 6.0 is still in preview mode. We will fully support these platforms as soon as the corresponding .NET 6.0 update is published.

Support for Visual Studio 2022

All Rebex libraries are now fully supported in Microsoft Visual Studio 2022.

Removed deprecated APIs

In this major release, we removed some APIs that have been deprecated for a very long time and seldom used. We will publish an article soon detailing these changes. In the meantime, if this affects you, please keep using release R5.7, and let us know. (R5.x will be supported until 2023-10-10.)

Support for reverse SSH tunnels

Finally, Rebex File Server supports incoming tunnels via SSH, also known as reverse port forwarding. Use FileServer.Settings.EnableReverseTunneling to enable this feature.

New Rebex.IO API

We added a set of new classes to Rebex.IO namespace that make it possible to access files and directories in custom file system providers using a simple API that resembles System.IO. The new classes are VFile, VFileInfo, VDirectory, VDirectoryInfo, VFileSystemInfo, VDriveInfo and VFileStream, and they are provided by Rebex.FileSystem assembly.

Support for ECDSA X.509 certificates in SSH

Added support for 'x509v3-ecdsa-sha2-nistp256', 'x509v3-ecdsa-sha2-nistp384' and 'x509v3-ecdsa-sha2-nistp521' SSH host key and client key algorithms (as specified by RFC 6187).

Detailed list of changes:

• All: Added a new set of binaries targeting .NET 6.0.
• All: Removed several obsolete and deprecated APIs.
• All: Removed support for legacy ISerializable interface from binaries for .NET Standard.
• File Server: Added support for incoming tunnels (also known as reverse tunneling or SSH port forwarding).
• File System: Added simple API (resembling System.IO) for working with contents of custom virtual file system providers.
• SSH: Added support for SSH key algorithms based on ECDSA X.509 certificates (RFC 6187).

R5.7 #

(version 5.0.7999 from 2021-11-24)

Support for .NET 6.0 and Windows 11

Windows 11 is now a supported platform.

Rebex assemblies targeting .NET Standard 2.1 now support .NET 6.0.

Support for PuTTY PPK3 key format

SshPrivateKeyclass, PrivateKeyInfo class and Certificate.SavePrivateKey method now support PuTTY's new PPK version 3 private key format.

Support for 'x509v3-rsa2048-sha256' SSH cipher

Added support for 'x509v3-rsa2048-sha256' SSH host key and client key algorithm (X.509 certificate with RSA key, as specified by RFC 6187).

Improved Deflate compression performance

Deflate compression performance has been improved (mostly on modern platforms). This improves performance of SSH layer (when compression is enabled).

Detailed list of changes:

• All: Added support for .NET 6.0 on Windows, Linux and macOS.
• All: Added support for Windows 11.
• File System: Added new constructor to LocalFileSystemProvider, MemoryFileSystemProvider and MountCapableFileSystemProvider that accepts FileSystemSettings.
• File System: Optimized VFS internals.
• SSH: Added support for PuTTY PPK3 format to SshPrivateKey.
• SSH: Added support for 'x509v3-rsa2048-sha256' SSH key algorithm (RSA X.509 certificates, RFC 6187).
• SSH: Added workaround for a server with broken SSH window size handling logic.
• SSH: Fixed handling of oversized data packets from servers with broken window size.
• TLS Core: Improved TLS 1.3 performance.
• Cryptography: Added more values to X.509 RevocationReason enum.
• Cryptography: Added support for private keys in PuTTY PPK3 format (uses Argon2 key derivation function).
• Cryptography: Added workaround for Google's CRLs with non-constructed explicit ASN.1 nodes.

R5.6 #

(version 5.0.7970 from 2021-10-26)

Support for .NET 6.0 RC2

Rebex assemblies targeting .NET Standard 2.1 have been fully tested on .NET 6.0 RC2 and are suitable to be used in production on Microsoft's latest .NET platform ahead of the official release.

Maintenance release

This release brings several enhancements and resolves issues in virtual file system API and server-side SFTP.

Detailed list of changes:

• All: Added support for .NET 6.0 RC2.
• File Server: Fixed compatiblity between WinSCP's SFTP v5 implementation and writable non-seekable custom streams.
• File System: Fixed internal reader-writer lock in virtual file system provider that could cause a deadlock in some scenarios with multiple parallel operations.
• TLS Core: Fixed possible NullReferenceException in TLS 1.2 socket after it has been closed.
• TLS Core: Improved handling of exceptions in TlsSocket.Send method.
• Cryptography: Fixed handling of RSAParameters without DP/DQ in AsymmetricKeyAlgorithm and PrivateKeyInfo.
• Cryptography: Fixed loading of encrypted keys with empty passwords in new OpenSSH format.
• Cryptography: Small optimization in AVX2 implementation of ChaCha20.

R5.5 #

(version 5.0.7900 from 2021-08-17)

New binaries for .NET Core 3.1

We added a new set of binaries targeting .NET Core 3.1. We have already been supporting that platform since 2019 via .NET Standard 2.1. However, the new set of binaries utilizes .NET Core's hardware intrinsics API and features our fast ChaCha20/Poly1305 implementation that has been previously only available on .NET 5.0.

For an overview of available binaries and supported platforms, check out Rebex Support Lifecycle KB article.

Fixed permission requested for 'rename' operation

When renaming a file, FileServer now requests read permission in addition to delete for the source path in PathAccessAuthorization event.

Detailed list of changes:

• All: Added 'netcoreapp3.1' binaries.
• All: Fixed compatibility with UWP and .NET Native compiler.
• File Server: Added ServerEndPoint and ServerAddress properties to relevant server event arguments and ServerSession class.
• File Server: Requesting 'Read' permission in addition to 'Delete' for source path of rename operation in PathAccessAuthorization event.

R5.4 #

(version 5.0.7888 from 2021-08-05)

Maintenance release

This release adds ServerEndPoint and ServerAddress properties to server event arguments and ServerSession class.

Detailed list of changes:

• Networking: Fixed casing in 'Basic' HTTP proxy authorization header.
• TLS Core: Fixed parsing of TLS 1.3 Certificate handshake message spanning multiple records.
• Cryptography: Fixed Certificate.FriendlyName setter in .NET 5.0 on non-Windows platforms.

R5.3 #

(version 5.0.7840 from 2021-06-18)

Fixed FIPS-mode detection in .NET 4.8

This release fixes an issue in FIPS-mode detection routine that was not working properly in applications targeting .NET Framework 4.8 due to a change in the framework's behavior. This only affects applications targeting .NET Framework 4.8. Applications targeting earlier framework versions do not suffer from this issue even when running on .NET Framework 4.8.

If your application targets .NET Framework 4.8 and is supposed to honor system-wide FIPS mode settings, either upgrade to this release, or set Rebex.Security.Cryptography.CryptoHelper.UseFipsAlgorithmsOnly to System.Security.Cryptography.CryptoConfig.AllowOnlyFipsAlgorithms in your application's startup code.

SFTP v5 support

Rebex SFTP Server (FileServer class) supports SFTP v5 now. This improves compatibility with WinSCP client, which expects SFTP v5 to enable File Hashing extension that makes it possible to calculate checksums of remote files.

Detailed list of changes:

• File Server: Added support for SFTP v5.
• File Server: Fixed compatibility issues in SCP protocol.
• File System: Fixed obfuscated method names in FileSystemProvider log.
• File System: MountCapableFileSystemProvider's FileSystemNotifier raises GetAttributesPreview, GetAttributesSurrogate and GetAttributesCompleted events for mounted directories.
• File System: Tweaked handling of non-seekable streams supplied to NodeContent.CreateReadOnlyContent method.
• SSH: Fixed race condition in OpenSSH-style compression startup code (occasionally caused connection failures during authentication with SSH compression was enabled).
• TLS Core: Added SslSettings.​SetPreferredSuites/​GetPreferredSuites methods to make it possible to specify client-side TLS cipher preference.
• TLS Core: Improved logging when remote party does not support TLS 1.3.
• TLS Core: Optimized TlsSocket.Negotiate method when TLS 1.3 is enabled but not supported by the remote side.
• TLS Core: Prevented 'unobserved' exceptions in task-based TLS 1.2 core.
• Cryptography: Added support for private keys using PBKDF2 with HMAC/SHA-2 (RFC 8018 / PKCS #5 v2.1).
• Cryptography: Fixed detection of FIPS-only systems on .NET Framework 4.8.
• Cryptography: Optimized creation of algorithm objects in CNG layer.

R5.2 #

(version 5.0.7800 from 2021-05-09)

New ChaCha20Poly1305 class

This release features the new ChaCha20Poly1305 class that implements the 'combined mode' AEAD cipher consisting of ChaCha20 stream cipher and Poly1305 authenticator, as specified by RFC 7539.

Improved performance of AES/CTR ciphers in SSH

AES/CTR is now faster on all platforms.

Faster ChaCha20/Poly1305 on older platforms

We further improved performance of ChaCha20/Poly1305 in TLS and SSH on older platforms. It's not as fast as our .NET 5.0 implementation using AVX2 or Advanced NEON SIMD, but it's faster than ever before.

Detailed list of changes:

• File Server: Fixed error handling in SSH session's periodic timer callback.
• File Server: Fixed handling of failed sessions to make sure they are removed from the sessions collection.
• File Server: Updated SshConsole.Clear() method to reset cursor position in addition to clear the screen.
• File System: Fixed handling of non-seekable streams supplied to NodeContent CreateReadOnlyContent method.
• Networking: Added support for SOCKS5 servers that respond with domain name.
• SSH: Optimized usage of ChaCha20/Poly1305 in SSH.
• Cryptography: Added ChaCha20Poly1305 class that implements ChaCha20/Poly1305 with an API that resembles .NET's AesGcm class.
• Cryptography: Added support for loading of ECDSA certificates from PFX/P12 files in .NET 5.0 and .NET Standard 2.1 on Linux and macOS.
• Cryptography: Added support for saving to PFX/P12 files for certificates with temporarily associated private keys in .NET 5.0 and .NET Standard 2.1 on Linux and macOS.
• Cryptography: AVX2 implementation of ChaCha20 releases old pre-generated keystream immediately after reinitialization.
• Cryptography: Clearing output data in AesGcm class when authentication tag is invalid.
• Cryptography: Fixed parsing of Cryptographic Message Syntax envelopes with unsupported OIDs.
• Cryptography: Improved ChaCha20/Poly1305 performance on .NET 3.5-4.6 and .NET Standard 2.x.
• Cryptography: Improved performance of AES/CTR ciphers (used in SSH).
• Common: Improved error handling when raising events via synchronization context.

R5.1 #

(version 5.0.7733 from 2021-03-03)

Simplified release naming

We decided to drop the year from our release naming scheme. Instead of '2020 R5.1', this release is called just 'R5.1', and the forthcoming releases will use the same 'R5.x' naming scheme until the next major upgrade.

Faster ChaCha20/Poly1305 in .NET 5.0

By utilizing AVX2 (on Intel/AMD) or Advanced NEON SIMD (on ARM) via .NET's new hardware intrinsics API in .NET 5.0, we made our ChaCha20/Poly1305 implementation in SSH and TLS much faster. On ARM64, ChaCha20/Poly1305 is now even faster than Windows native AES/GCM.

This release improves ChaCha20/Poly1305 performance on older platforms as well, although not by such a big margin.

Improved compatibility of File Server with WinFsp/SSHFS

For some reason, when WinFsp/SSHFS performs a rename operation on a mounted SFTP filesystem, it first opens the file being renamed. This caused the rename operation to fail with Rebex SFTP Server, because we were opening files without specifying the file sharing mode that would allow this. We changed this, and Rebex File Server is now compatible with SSHFS by default.

To restore the previous behavior, set FileServer.Settings.FileShareMode to FileShare.Read.

Detailed list of changes:

• All: Changed release naming scheme ('R5.1' instead of '2020 R5.1').
• File Server: Added FileServer.Settings.FileShareMode property to make it possible to specify file share mode for opened files.
• File Server: Added ShellCommandEventArgs.Raw property (contains unparsed arguments for custom command).
• File Server: Fixed behavior of FileServer.Unbind(EndPoint) method.
• File Server: Fixed race condition when closing outstanding file handles during SFTP channel closure.
• File Server: Changed default value for Settings.KeepAlivePeriod to 300 seconds.
• File Server: Improved error messages when no SSH server keys or bindings were specified when starting the server.
• File System: Fixed return type of Move and Rename operations in FileSystemProvider when using instances of classes derived from DirectoryNode and FileNode.
• File System: Length property of a Stream returned from LocalFileSystemProvider is updated properly after a write operation.
• File System: MountCapableFileSystemProvider allows 'Move' operation between different mounted file system providers.
• Networking: Added workaround for rare WSAEWOULDBLOCK error on Mono in Socket.Connect.
• Networking: More meaningful exception is throw when attempting to use HTTP CONNECT proxy with NTLM authentication on platforms that don't support it.
• Networking: Optimized timeout infrastructure in ProxySocket.Connect.
• SSH: Added workaround for WingFTPServer server that uses 'ssh-rsa' with SHA-2 when client announces RSA/SHA-2 support.
• SSH: Fixed format of SshPublicKey.GetPublicKey() response for public keys initialized from PublicKeyInfo or AsymmetricAlgorithm.
• SSH: Fixed handling of unknown channel requests (not sending reply if not requested).
• TLS Core: Added VerifyMessage signature algorithm logging in TLS 1.3.
• TLS Core: Close/Dispose method called on TLS 1.3 socket ensures that all outstanding IO operations are canceled before the control is returned to the caller.
• TLS Core: Fixed possible rare NullReferenceException when closing TLS 1.3 session.
• TLS Core: Synchronous methods on TlsSocket wrap TaskCanceledException to TlsException.
• Cryptography: Added workaround to Certificate.LoadDer method to enable loading of certificates in PKCS #7 containers.
• Cryptography: Enhanced implicit operator for conversion of Certificate->X509Certificate2 to retain private keys on non-Windows platforms as well.
• Cryptography: Fixed Ed25519 PKCS #8 key structure (now compatible with OpenSSL).
• Cryptography: Optimized memory usage in symmetric encryption transformations based on Windows CNG API.
• Cryptography: Substantial speed-up of ChaCha20/Poly1305 (used in SSH and TLS). Utilizing AVX2 or Advanced NEON SIMD on .NET 5.0 (if available).
• Common: Accelerated common byte array operations in .NET 5.0 on devices with AVX2 support.

2020 R5 #

(version 5.0.7620 from 2020-11-10)

Support for .NET 5.0!

This release adds a new set of binaries targeting .NET 5.0. It supports all .NET 5.0 platforms:

• Windows (x64, x86, ARM64)
• Linux (x64, ARM32, ARM64)
• macOS (x64)

Built-in Ed25519 support

We have already been supporting Ed25519 (EdDSA on edwards25519 curve) in SSH for several years, but an external plugin was needed to make it work. That is no longer case, and ssh-ed25519 SSH cipher works out-of-the-box.

Virtual file system improvements

This release brings several enhancements and optimizations to our virtual file system API.

New AES/GCM API

Our new Rebex.Security.Cryptography.AesGcm class resembles .NET 5.0's class of the same name, but it's available on all supported platforms including .NET Framework 3.5/4.0 and Mono 5/6.

Detailed list of changes:

• All: Added support for .NET 5.0 on all platforms.
• File Server: Increased SFTP receive buffer size.
• File System: Added IsDelayedWriteContent and IsImmediateWriteContent properties to the NodeContent class.
• File System: FileSystemNotifier raises SaveContentSurrogate event for 'delayed write' instances of the NodeContent that have been created previously in the handler of the GetContentSurrogate event or GetContentCompleted event.
• File System: Optimized critical sections in virtual file system providers.
• File System: Optimized handling of small files in MemoryFileSystemProvider.
• File System: Optimized internal communication between virtual and physical file systems.
• File System: Optimized memory usage in the MemoryFileSystemProvider under typical scenarios.
• File System: SetContent method in the LocalFileSystemProvider file nodes now truncates the underlying file before writing the new content (does not affect SFTP).
• File System: Virtual file system providers throw a FileSystemException when a source node is same as a target node.
• TLS Core: Added support for X.509 certificates with Ed25519 keys to TLS 1.3.
• TLS Core: Improved exception messages in TLS 1.3.
• Cryptography: Added built-in support for Ed25519 algorithm.
• Cryptography: Added Rebex.Security.Cryptography.AesGcm class (equivalent to .NET 5.0's AesGcm class, but available on all platforms including .NET Framework 3.5).
• Cryptography: Added SetOtherNames/GetOtherNames methods to CertificateInfo class ('Other Name' support in SANs).
• Cryptography: AsymmetricKeyAlgorithm.ImportKey method can initialize Ed25519 key from seed (in addition to private key).
• Cryptography: AsymmetricKeyAlgorithm.Register method made thread-safe.
• Cryptography: Deprecated CryptoHelper.ForceManagedAes property.
• Cryptography: Enhanced compatibility with unsupported legacy versions of CryptoAPI.
• Cryptography: Enhanced SignedData.Load(Stream) and EnvelopedData.Load(Stream) methods to support Base64-encoded format (PEM) as well.
• Cryptography: Enhanced workaround for RSA CSPs with lack of SHA-2 support.
• Common: Added SspiAuthentication.IsSupported method.
• Common: Enhanced EncodingTools helper class to always provide Encodings with implemented HeaderName, EncodingName and BodyName properties.

2020 R4 #

(version 5.0.7579 from 2020-09-30)

Fully tested on .NET 5.0 RC1

Rebex assemblies targeting .NET Standard 2.1 have been fully tested on .NET 5.0 RC1 and are suitable to be used in production on Microsoft's latest .NET platform.

Maintenance release

This release brings several enhancements and resolves some issues in virtual file system API and elsewhere.

Detailed list of changes:

• All: Fixed several minor compatibility issues on .NET 5.0 RC1.
• File Server: Added workarounds for incompatibilities in SSH renegotiation with JSCH, SSH.NET and very old OpenSSH.
• File Server: Enhanced FileServer infrastructure API to make it possible to start SFTP/SSH session on a pre-connected Socket.
• File Server: Enhanced virtual shell's mkdir command to support '-p' option.
• File Server: Fixed algorithm support check when adding an Ed25519 key to FileServer.Keys collection.
• File Server: Fixed behavior of SSH_FXP_MKDIR on non-Windows operating systems.
• File System: Added Length property to the NodeContent class.
• File System: Added OriginalNode property to FileSystemNotifier.RenameCompleted event argument.
• File System: Added SaveContentPreview, SaveContentSurrogate and SaveContentCompleted events to virtual file systems.
• Networking: Restored missing NetworkSession.InstanceId property.
• TLS Core: Fixed concurrent access in server-side TLS session cache.
• TLS Core: Fixed normalization of premaster secret in server-side ECDH calculations in TLS 1.2 and earlier.
• TLS Core: Updated TlsCipherSuite.Secure/Weak/Fast enum values. Updated TlsParameters.AllowedSuite default.
• Cryptography: Added Ed25519 support to Certificate class. (Not yet supported by the built-in certificate validator due to lack of support in Windows and .NET).
• Cryptography: Fixed handling of non-content data in Certificate(byte[]) constructor and CertificateChain.LoadP7b(Stream) / CertificateRevocationList.​Load(Stream) methods.
• Cryptography: Fixed parsing of constructed primitive ASN.1 types with more than two layers of nesting.
• Cryptography: Fixed version number in PKCS #10 CertificationRequest structure.
• Cryptography: Prohibited usage of Chacha20/Poly1305 in TLS 1.3 in FIPS-only mode. (Already prohibited in TLS 1.2 or earlier.)
• Cryptography: Updated RSAManaged constructor logic to make it suitable as a base for derived classes on .NET Framework in FIPS-compliant mode.
• Cryptography: Using Windows CNG API for Diffie-Hellman parameter generation on Windows 10 and Windows Server 2016/2019.
• Common: Optimized internal cancellation infrastructure on old platforms.
• Common: Removed usage of BinaryFormatter which has been found to be insecure.
• Common: Updated EncodingTools.GetEncoding method to prefer encodings provided by .NET.

2020 R3 #

(version 5.0.7501 from 2020-07-14)

Binaries for .NET Standard 2.1

We added a new set of binaries targeting .NET Standard 2.1. They are suitable for .NET Core 3.1 and .NET 5.0 Preview 6, on Windows, Linux and macOS.

For an overview of available binaries and supported platforms, check out Rebex Support Lifecycle KB article.

Detailed list of changes:

• All: Added binaries targeting .NET Standard 2.1.
• File Server: Added support for anonymous authentication.
• File Server: Fixed handling of unknown SSH packets received before authentication.
• File Server: Changed SSH cipher info logging style (unified with client-side SSH).
• File Server: Workaround for very old OpenSSH 4.x/5.x clients that refuse to accept data packets while SSH renegotiation is in progress.
• SSH: Enhanced legacy group exchange autodetection.
• TLS Core: Added TlsSocket.ApplicationProtocol property to make it possible to determine protocol negotiated using ALPN extension.
• TLS Core: Always preferring RSA/SHA-2 for client certificate authentication in TLS 1.2.
• TLS Core: Disabled ciphers based on AES/CBC and SHA-2 in legacy versions of TLS (they are only specified by TLS 1.2).
• TLS Core: Fixed availability of TLS 1.3 session tickets (client side).
• TLS Core: Fixed handling of multiple concurrent Receive or Send method calls in TLS 1.3.
• TLS Core: Fixed handling of TLS 1.3 KeyUpdate handshake message.
• TLS Core: Fixed server name handling for TlsSocket instances created from an already-connected Socket.
• TLS Core: Fixed TlsException.Status to return ConnectionClosed for connection-closed errors.
• TLS Core: Fixed TlsException.Status to return Timeout for timeout errors.
• TLS Core: Fixed TlsSocket.ClientCertificate that returned an empty chain instead of null in some scenarios.
• TLS Core: Improved error message when server certificate is rejected in TLS 1.3.
• TLS Core: Improved error messages in TLS 1.3.
• TLS Core: Logging improvements.
• TLS Core: No longer sending 'internal error' alert to remote end on timeout.
• TLS Core: Optimized TLS 1.3 internals.
• TLS Core: TLS 1.3 initiates key update properly (before the AEAD limits are reached).
• TLS Core: Unified behavior of the Receive and ReceiveAsync methods across TLS versions.
• Cryptography: Fixed encoding of ECDSA signatures in PKCS #7 CertificationRequest structure.
• Cryptography: Memory usage optimizations in CNG layer.
• Cryptography: On Windows 10 and Windows Server 2016 or higher, Windows CNG API is used for classic Diffie-Hellman calculations instead of legacy Windows CryptoAPI.
• Cryptography: Optimized disposing of temporary keys in Certificate class.

2020 R2 #

(version 5.0.7450 from 2020-05-24)

Support for AES/GCM, ChaCha20/Poly1305 and EtM MAC ciphers in SFTP/SSH server

This release adds support for the following modern SSH AEAD encryption ciphers to Rebex File Server:

• aes128-gcm@openssh.com
• aes256-gcm@openssh.com
• chacha20-poly1305@openssh.com

It also adds support for the following encrypt-then-MAC ciphers:

• hmac-sha2-256-etm@openssh.com
• hmac-sha2-512-etm@openssh.com

Detailed list of changes:

• File Server: Added FileServerSettings.​EnableEventsForFailedTransfers option.
• File Server: Added ServerSession.Cipher property to make it possible to determine SSH ciphers used by each session.
• File Server: Added support for AEAD encryption ciphers ('aes128-gcm@openssh.com', 'aes256-gcm@openssh.com' and 'chacha20-poly1305@openssh.com').
• File Server: Added support for encrypt-then-MAC ciphers ('hmac-sha2-256-etm@openssh.com' and 'hmac-sha2-512-etm@openssh.com').
• File Server: Enhanced handling of 'pty-req' and 'window-change' SSH channel requests - wrong values are rejected.
• File Server: Enhanced ShellModule class to make it possible to implement custom SSH subsystems.
• File Server: Fixed client authentication using X.509 certificates.
• File Server: Fixed handling of unknown SSH packets.
• File Server: Virtual shell now treats the line-feed character as end-of-line indicator in addion to carriage-return character.
• SSH: Added new properties to SshCipher to make it possible to determine IDs of active ciphers.
• SSH: Added workaround for a weakness in legacy CBC ciphers.
• TLS Core: Enhanced TlsSocket.Timeout property to apply to subsequent Send, SendAsync, Receive and ReceiveAsync methods even when TLS is already active.
• TLS Core: Fixed availability of TLS 1.3 session ticket when the receive side of the connection has already been closed.
• TLS Core: Fixed behavior of server-side DoNotCacheSessions option (which previously led to connection failures).
• TLS Core: Fixed some cases of missing AggregateException unwrapping.
• TLS Core: Improved and unified behavior of TlsSocket Shutdown/ShutdownAsync methods when negotiation has not been started.
• TLS Core: Improved TLS exception reporting.
• TLS Core: Logging improvements.
• TLS Core: Optimizations in TLS 1.3 internals.
• TLS Core: Support for the TLS 1.3 record with empty application data payload and random padding.
• TLS Core: Unified TlsSocket.Cipher property behavior across TLS versions.
• Cryptography: Added ContentInfo.ToStream() method.
• Cryptography: Enhanced Certificate.LoadDerWithKey to support RSASSA-PSS and RSAES-OAEP for RSA keys.
• Cryptography: Fixed AsymmetricKeyAlgorithm.​GenerateDiffieHellmanParameters slowness (only affected the previous release).
• Cryptography: Improved AsymmetricKeyAlgorithm to support RSASSA-PSS and RSAES-OAEP with keys loaded via ImportKey method.
• Cryptography: Optimized Certificate and CertificateChain class to only consume native resources when needed.
• Cryptography: Optimized CNG handles cleanup.

2020 R1.1 #

(version 5.0.7390 from 2020-03-25)

Fixed a renegotiation issue that could lead to decryption error

After we started using Windows 10's native X25519 curve support, the shorter duration of SSH key exchange uncovered a bug that occasionally causes an SSH session failure following an SSH renegotiation. The issue manifested itself as a decryption error at the client side. The cause of this problem has now been fixed. If you are currently using Rebex File Server 2020 R1, upgrading to 2020 R1.1 is recommended.

Reintroducing fast Diffie-Hellman on Xamarin.Android

Until 2019 R4.2, Rebex binaries for Xamarin.Android platforms used Android's cryptographic API for Diffie-Hellman calculations. However, this functionality is no longer available in current Rebex binaries targeting Xamarin.Android via .NET Standard 2.0. To make it possible to use the faster Diffie-Hellman implementation on Xamarin.Android again, we have added it to our native extensions library. Once enabled, it will make Diffie-Hellman key exchange in SSH as fast on Xamarin.Android as before.

Detailed list of changes:

• File Server: Fixed a renegotiation issue that could lead to decryption error.
• File Server: Fixed FileServer.Stop() method to no longer fail with 'The specified socket is already in use' error in rare scenarios.
• File Server: Fixed partial authentication message processing to ensure no authentication method is used twice during a single authentication session.
• File Server: Fixed reporting of writable permissions for read-only items.
• Networking: Fixed rare race condition in TLS and SSH internals.
• TLS Core: Fixed breaking changes in the behavior of seldom-used parts of TlsSocket API.
• TLS Core: Fixed handling of OperationCanceledException in TLS 1.3 core.
• TLS Core: Improved TLS logging.
• Common: Added DiffieHellmanNative class to Rebex.Common.Native assembly (speeds up Diffie-Hellman calculations on Xamarin.Android).

2020 R1 #

(version 5.0.7357 from 2020-02-21)

.NET Standard 2.0 on Xamarin.Android and Xamarin.iOS

Rebex binaries targeting .NET Standard 2.0 are now supported on Xamarin.Android and Xamarin.iOS. Previously-available binaries targeting specific Xamarin platforms have been deprecated, and .NET Standard 2.0 binaries should be used instead.

Note: Applications that require certificate validation also need to use the new Rebex.Common.Native.dll assembly which provides validation of X.509 certificates on Xamarin.Android and Xamarin.iOS.

Native X25519 elliptic curve support on Windows 10

On Windows 10, Windows Server 2016 and Windows Server 2019, Rebex libraries using ECDH key exchange in TLS or SSH now support X25519 curve (also known as Curve25519) without any external plugins.

Better Elliptic Curve Diffie-Hellman support on Windows 10

On Windows 10, Windows Server 2016 and Windows Server 2019, Rebex libraries now fully supports ECDH key exchange without having to rely on external plugins and workarounds.

Support for server-side file hash calculation

Support for check-file SFTP extension has been added to Rebex File Server, making it possible for SFTP clients (such as Rebex SFTP) to retrieve hashes of remote files.

End of Standard Support for .NET Framework 2.0 and 3.0

2019 R4.2 was the last release to include support for .NET Framework 2.0 and 3.0 in the standard package. Customers using these platforms are advised to migrate to .NET Framework 3.5 SP1, which will enjoy mainstream support until 2023-10-10.

For customers who are unable to migrate, a Legacy Edition of Rebex libraries for .NET Framework 2.0/3.0 is available.

Deprecated .NET Core 1.0/1.1

.NET Core 1.1 and 1.0 became end-of-life platforms at 2019-06-27. In accordance with our framework support policy, they are no longer supported by Rebex libraries. Customers using these platforms are advised to migrate to .NET Core 2.1 or .NET Core 3.1.

Detailed list of changes:

• All: Binaries targeting .NET Standard 2.0 now support Xamarin.Android and Xamarin.iOS.
• All: Deprecated binaries targeting .NET Standard 1.5, Xamarin.Android and Xamarin.iOS.
• All: Fixed several occurences of culture-sensitive string formatting.
• All: Fixed several occurrences of wrong synchronization context.
• All: Mainstream edition no longer supports .NET Framework 2.0/3.0 and .NET Core 1.0/1.1.
• File Server: Added full support for Elliptic Curve Diffie-Hellman (ECDH) on Windows 10, Windows Server 2016 and Windows Server 2019.
• File Server: Added support for 'curve25519-sha256' key exchange cipher (equivalent to already-supported 'curve25519-sha256@libssh.org').
• File Server: Added support for 'check-file' SFTP extension, making it possible to calculate hashes of remote files.
• SSH: Added full support for Elliptic Curve Diffie-Hellman (ECDH) on Windows 10, Windows Server 2016 and Windows Server 2019.
• SSH: Added support for 'curve25519-sha256' key exchange cipher (equivalent to already-supported 'curve25519-sha256@libssh.org').
• SSH: Enhanced performance of ChaCha20-Poly1305 cipher ('chacha20-poly1305@openssh.com') in SSH client.
• SSH: Fixed possible deadlock in SSH client when processing incoming EOF packet while waiting for remote receive buffer size to increase.
• TLS Core: Added asynchronous methods to TlsSocket base class.
• TLS Core: Added SetSymmetricCipherSuites/​GetSymmetricCipherSuites methods to configure enabled TLS 1.3 cipher suites.
• TLS Core: Added support for ChaCha20-Poly1305 cipher suites to TLS 1.3 and 1.2.
• TLS Core: Fixed behavior of TlsSocket methods after Dispose has been called.
• TLS Core: Fixed behavior of TlsSocket.Shutdown.
• TLS Core: Improved argument checks in TlsSocket base class.
• TLS Core: Improved multi-pass parsing of the TLS 1.3 records.
• TLS Core: Many optimizations in TLS 1.3 core.
• Cryptography: Added full support for Elliptic Curve Diffie-Hellman (ECDH) on Windows 10, Windows Server 2016 and Windows Server 2019.
• Cryptography: Added native support for ECDH with X25519 curve on Windows 10, Windows Server 2016 and Windows Server 2019.
• Common: Internal optimizations.

2019 R4.2 #

(version 5.0.7320 from 2020-01-15)

Maintenance release

This release solves several issues in the shared functionality.

Detailed list of changes:

• SSH: Fixed possible deadlock during SSH renegotiation (client-side).
• TLS Core: Fixed renegotiation in TLS 1.2 (has been broken since 2019 R4).
• Cryptography: Added workaround for RSA signatures shorter than the key size (.NET Core on Linux is unable to handle them).
• Cryptography: Fixed AsymmetricKeyAlgorithm.​GetRawPublicKey() key format when RSA via MS CNG is in use.
• Cryptography: Only known external plugins are allowed for enhanced security.
• Cryptography: Saving public key as well when saving X25519 private keys.

2019 R4.1 #

(version 5.0.7290 from 2019-12-16)

.NET Core 3.1 support

.NET Core 3.1 is now supported on the following platforms:

• Windows (x64, x86, ARM32)
• Windows 10 IoT (x64, x86, ARM32)
• Linux (x64, ARM32)
• macOS (x64)

Detailed list of changes:

• All: Added support for .NET Core 3.1.
• All: Added support for Mono 6.x.
• File Server: Added FileServer.Settings.MaxIdleDuration and IgnoreKeepAlive to make it possible to easily force closure of idle sessions.
• Networking: Added missing 'buffer' argument check to some Send/Receive methods in ProxySocket/TlsSocket.
• Networking: Fixed unhandled ObjectDisposedException or misleading SocketException when ProxySocket.Connect aborted due to timeout.
• SSH: Added a workaround for a bug introduced in OpenSSH 8.0 that rejects 'sender channel' numbers in the upper half of uint32 range.
• SSH: Added SshEncryptionMode.AEAD (to replace SshEncryptionMode.GCM).
• SSH: Added support for ChaCha20-Poly1305 AEAD cipher ('chacha20-poly1305@openssh.com') to SSH client.
• TLS Core: Added support for RSASSA-PSS signatures in TLS 1.2 when TLS 1.3 has been enabled.
• TLS Core: Avoid unwanted truncation of outgoing TLS 1.3 messages when TlsSocket is disposed.
• TLS Core: Enhanced error message when no suitable curve is available.
• TLS Core: Fixed compatibility issue with Xamarin's "Sdk Assemblies Only" option.
• TLS Core: Fixed exception type to TlsException for TLS 1.3 errors.
• TLS Core: Fixed handling of TLS 1.3 PSK-KE.
• TLS Core: Fixed check of signature algorithm in TLS 1.3 CertificateVerify.
• TLS Core: Fixed occasional failure when negotiating TLS 1.2 or lower when TLS 1.3 is allowed.
• TLS Core: Fixed order of supported signature schemes in TLS 1.3 ClientHello message.
• TLS Core: Fixed parsing of fragmented TLS 1.3 handshake messages.
• TLS Core: Fixed parsing of the TLS 1.3 KeyShare extension.
• TLS Core: Fixed potential NullReferenceException when TLS 1.3 negotiation has been interrupted unexpectedly.
• TLS Core: Fixed selection of signature algorithm used in CertificateVerify handshake messages.
• TLS Core: Not announcing support for X.509 certificates with Ed25519 or RSASSA-PSS public key OID (not supported yet).
• TLS Core: Optimizations in TLS 1.3 internals.
• Cryptography: Added workaround for bad RSA/PSS signature algorithm identifiers with missing parameters.
• Cryptography: Enabled workaround for private key loading from Mono key store in .NET Standard edition on Mono.
• Cryptography: Enhanced 'Invalid key format' error message when loading a private key.
• Cryptography: Fixed serial number handling in CertificateIssuer to conform to RFC 5280 constraints.
• Common: Binaries for .NET Standard 1.5 now use System.Collections.NonGeneric instead of custom implementations.
• Common: Enabled Xamarin.Android workarounds in .NET Standard 2.0 edition.
• Common: Improved ISafeSerializationData support detection.

2019 R4 #

(version 5.0.7244 from 2019-10-31)

Enhancement release

This release brings several enhancements and improvements.

Detailed list of changes:

• File Server: Enhanced handling of exceptions in custom events.
• File Server: Enhanced normalization of Windows-like paths (only applies to AcceptWindowsPaths option).
• File Server: Fixed timing out of not-yet-authenticated sessions.
• TLS Core: Added support for ALPN TLS extension to TlsSocket.
• TLS Core: Added TlsBulkCipherMode.AEAD (to replace TlsBulkCipherMode.GCM).
• TLS Core: Removed support for two legacy unsecure anonymous ciphers (DH_anon_EXPORT_WITH_DES40_CBC_SHA and DH_anon_EXPORT_WITH_RC4_40_MD5).
• Cryptography: Added PkcsBase.LoadSignedOrEnvelopedData method (a replacement for deprecated PkcsBase.Load).

2019 R3.2 #

(version 5.0.7206 from 2019-09-23)

.NET Core 3.0 support

This release introduces support for .NET Core 3.0 on the following platforms:

• Windows (x64, x86, ARM32)
• Windows 10 IoT (x64, x86, ARM32)
• Linux (x64, ARM32)
• macOS (x64)

Windows 10 IoT support

This release introduces support for .NET Core 3.0 on Windows 10 IoT on x64, x86 and ARM32 platforms.

Detailed list of changes:

• All: Added support for .NET Core 3.0.
• All: Added support for Windows 10 IoT (via .NET Core 3.0).
• File Server: More common forms of ungraceful session termination are no longer logged as errors at LogLevel.Error.
• File System: Added FileServerUser constructors that accept FileSystemProvider.
• SSH: Added SshGssApiCredentials.AccountName property to make it possible to specify an account name to be passed to the SSH server.
• SSH: Added workaround for legacy WS_FTP 7.x servers that encode long SSH packets improperly.
• SSH: Fixed SshChannel.SendEof method not to send EOF when channel has already been closed.
• Common: Optimized internal Task infrastructure on old .NET platforms.

2019 R3 #

(version 5.0.7119 from 2019-06-28)

Support for .NET Standard 2.0 on Mono 5.14 and higher

Binaries of Rebex libraries targeting .NET Standard 2.0 are now also supported on Mono 5.14 and higher.

End of Standard Support for .NET Compact Framework 3.5 and 3.9

2019 R3 is the last release that includes support for .NET Compact Framework 3.5 and 3.9 in the standard package. Starting with 2019 R4, .NET CF 3.5/3.9 will only be supported with Legacy Editions, which will be available as separate products. See their release history.

Detailed list of changes:

• All: Binaries targeting .NET Standard 2.0 are now supported on Mono 5.14 or higher.
• File Server: Added dependency on Rebex.FileSystem to NuGet package for Rebex.FileServer.
• File Server: Added FileServerSettings.​MaxPendingConnectionsQueueLength (specifies the maximum queue length of the listening socket)
• File Server: Fixed rare NullReferenceException while enumerating FileServer.Sessions.
• SSH: Added SshPrivateKey.Generate(...) methods on .NET Compact Framework.
• SSH: Added workaround for broken EtM ciphers in OpenSSH 6.6.
• SSH: Enhanced GlobalScape SSH server detection.
• SSH: Enlarged upper limit for non-standard DSA keys to 8192 bits on .NET Framework and .NET Core.
• SSH: Fixed reporting of SSH_MSG_USERAUTH_GSSAPI_ERROR and SSH_MSG_USERAUTH_GSSAPI_ERRTOK responses.
• TLS Core: Added TlsCipherSuite.Fast enum value.
• TLS Core: Fixed a bug in server-side mode of TlsSocket that caused client certificate authentication to fail.
• TLS Core: Internal changes in the TLS layer (in preparation for the upcoming TLS 1.3 support on mainstream platforms).
• Cryptography: Added Certificate.GetPrivateKeyInfo() method.
• Cryptography: Added CertificateEngine.LocalMachine engine and CertificateEngine.Bind method.
• Cryptography: Added support for SHA-224 hash algorithm.
• Cryptography: Added support for X25519 key format (RFC 8410).
• Cryptography: Always using AES by default to encrypt PKCS #8 private keys.
• Cryptography: Meaningful error message for the CNG AEAD auth tag mismatch.
• Common: Optimized asynchronous continuations on modern platforms.
• Common: Upgraded Task infrastructure in Xamarin.Android binaries.

2019 R2 #

(version 5.0.7077 from 2019-05-17)

Support for Visual Studio 2019

All Rebex libraries are now fully supported in Microsoft Visual Studio 2019.

Support for .NET Framework 4.8

.NET Framework 4.8 is a fully supported platform.

Native elliptic curve cryptography on Linux with .NET Core 2.1 or higher

On Linux, binaries for .NET Standard 2.0 now utilize OpenSSL elliptic curve routines via .NET Core 2.1 (or higher), making it possible to use ECDH and ECDSA ciphers in TLS/SSL and SFTP/SSH with no need of external plugins.

Detailed list of changes:

• All: Added support for .NET Framework 4.8 and Visual Studio 2019.
• All: Removed leftover Trace.Write logging.
• File Server: Added an option to make the SFTP protocol accept Windows path (only on input).
• File Server: Fixed race condition related to remote window size that could lead to hung channels.
• File System: Fixed a bug in enumeration of nested mount points in MountCapableFileSystemProvider.
• SSH: Added dummy support for SSH_MSG_EXT_INFO (RFC 8308).
• Cryptography: Added CertificationRequest.Save method.
• Cryptography: Added support for ECDSA and ECDH on .NET Core 2.1/.2.2 on Linux (no need for external plugins).
• Cryptography: Added workaround for broken export of RSA keys from the CNG providers on Windows 7.
• Cryptography: Added workaround for CRLs with redundant trailing data to CertificateRevocationList.
• Cryptography: Added workaround for legacy versions of Mono with lack of SHA-2 support.
• Common: Asynchronous infrastructure improvements.

2019 R1 #

(version 5.0.7027 from 2019-03-28)

Improved platform support

This release adds three new sets of binaries targeting the following platforms:

• .NET Core 2.0/2.1/2.2 (via .NET Standard 2.0)
• .NET Framework 4.6.x/4.7.x
• .NET Framework 3.5 SP1

For an overview of available binaries and supported platforms, check out Rebex Support Lifecycle KB article.

MD5 deprecation in SshFingerprint

SshFingerprint's ToString() and ToArray() methods use SHA-256 now. To revert to previous behavior, specify SignatureHashAlgorithm.MD5 when calling these methods.

Rebex.FileSystem on .NET Framework 3.5

Virtual file systems in Rebex File Server are now supported on .NET Framework 3.5 SP1 as well.

Detailed list of changes:

• All: Added binaries targeting .NET Framework 3.5 SP1.
• All: Added binaries targeting .NET Framework 4.6 and higher.
• All: Added binaries targeting .NET Standard 2.0.
• All: Removed long-deprecated API. Deprecated legacy API.
• File Server: Added workaround for SocketAsyncEventArgs which could be leaking memory due to a bug in .NET Core 2.0 or earlier.
• File System: Rebex.FileSystem now supports .NET Framework 3.5 SP1.
• Networking: Fixed passing of state to the callback method in ProxySocket.BeginConnect and TlsSocket.BeginConnect.
• SSH: Changed behavior of SshFingerprint.ToString() and .ToArray() to use SHA-256.
• SSH: Improved performance of AES/GCM ciphers on .NET Compact Framework and non-Windows platforms.
• SSH: RSA host keys are preferred to DSA host keys.
• SSH: SHA-512 is only used during SSH client authentication when the RSA key length allows it.
• SSH: SshParameters.MinimumRsaKeySize now applies to client RSA keys as well.
• SSH: Using standard form of Diffie-Hellman group exchange with GlobalScape servers.
• TLS Core: Fixed passing of state to the callback method in ProxySocket.BeginConnect and TlsSocket.BeginConnect.
• TLS Core: Improved performance of AES/GCM ciphers on .NET Compact Framework and non-Windows platforms.
• Cryptography: Fixed behavior of HMAC mode in KeyMaterialDeriver.​DeriveKeyMaterial method.
• Cryptography: Fixed garbage collection issue with PFX-based certificate keys on non-Windows platforms.
• Cryptography: Fixed handling of shared secred padding in AsymmetricKeyAlgorithm.​GetKeyMaterialDeriver.​
• Cryptography: Fixed possible NullReferenceException in CertificationRequest.​GetAlternativeHostnames method.
• Common: Fixed Certificate.Associate with permanent bind on .NET Compact Framework to ensure the key is not garbage-collected.
• Common: LocalItem constructor no longer fails on items with invalid paths.

2018 R4 #

(build 6930 from 2018-12-21)

Password and key authentication in File Server

Support for authentication with both password and public key added to Rebex File Server.

Support for yet another OpenSSH key encryption

Added support for new OpenSSH keys with AES-CTR encryption.

Detailed list of changes:

• File Server: Added support for combined (password+key) authentication.
• File System: Added NodeContent.​WasStreamClosedForcefully property to make it possible to detect files closed due to failed SFTP connection.
• Networking: ProxySocket and TlsSocket implement IDisposable now.
• Networking: Added workaround to ProxySocket for ObjectDisposedException in Socket.ConnectAsync on .NET Core for macOS.
• SSH: Enhanced legacy group exchange autodetection.
• SSH: Fixed handling of Ssh.Encoding property.
• SSH: Fixed SshPublicKey(PublicKeyInfo) constructor that only accepted RSA or DSA keys.
• SSH: Fixed Verbose logging of interactive authentication.
• SSH: Changed SshParameters.MinimumRsaKeySize from 1024 to 1023 bits.
• TLS Core: Improved server certificate usage check.
• TLS Core: Improved TLS logging.
• Cryptography: Added support for 'BEGIN RSA PUBLIC KEY' keys (PKCS #1 / RFC 3447) to PublicKeyInfo.
• Cryptography: Added support for IP addresses in Subject Alternative Name certificate extension.
• Common: Added support for new OpenSSH key format with AES-CTR encryption.
• Common: Fixed possible certificate validation failures on some versions of Xamarin.Android.

2018 R3 #

(build 6874 from 2018-10-26)

Support for 'fsync@openssh.com' extension

Added support OpenSSH's fsync extension that makes it possible for client to ensure that modified file data has been written to disk.

Detailed list of changes:

• All: Added password-hiding in Verbose logging mode.
• All: Added experimental support for Mono on Windows.
• All: Fixed messages of some ObjectDisposedException objects.
• File Server: Added support for 'fsync@openssh.com' SFTP extension.
• File Server: Enhanced logging of channel requests.
• Networking: Added simple connection manager API on .NET Compact Framework (Rebex.Net.ConnectionManagement namespace).
• Networking: Report a meaningful error message when .NET Compact Framework's 'not a socket' issue is encountered.
• SSH: Added SshParameters.MaximumPacketSize property.
• SSH: Fixed Login not to block Dispose in Sftp, Scp and Ssh classes.
• SSH: Using UTF-8 at SSH protocol level by default in Sftp, Scp and Ssh classes.
• SSH: Added logging of SSH channel window size adjustments.
• SSH: Fixed decompression in encrypt-then-mac (EtM) MAC mode.
• TLS/SSL: TLS cipher suite being negotiated is logged as soon as possible.
• Cryptography: CertificateStore implements IEnumerable<Certificate>.
• Cryptography: Proper error is reported when trying to validate ECDSA certificates on Mono.
• Common: Added optimized thread pool on .NET Compact Framework.

2018 R2.1 #

(build 6821 from 2018-09-03)

Enhancements and bugfixes

This is a maintenance release with several bugfixes and enhancements.

Detailed list of changes:

• File Server: Fixed semi-random timeout exception in SFTP subsystem on extremely fast connections.
• File Server: Added FileServer.Settings.KeepAlivePeriod to make it possible to specify that keep-alive packets are to be sent after a period of inactivity.
• File Server: Fixed range check in the setter of FileServer.​Settings.​MaxSessionDuration and FileServer.​Settings.​MaxSessionTransferredBytes properties.
• Networking: Added Proxy.HttpUserAgent property to make it possible to specify User-Agent for HTTP CONNECT proxies.
• Networking: ProxySocket methods now throw ObjectDisposedException when disposed.
• SSH: Fixed data buffering when raising SshChannel.ExtendedDataReceived event.
• Cryptography: Optimized certificate signature validation on .NET Compact Framework.

2018 R2 #

(build 6755 from 2018-06-29)

New fully supported platform: .NET Core on macOS

This release adds full support for .NET Core 2.x on macOS.

Enhancements and bugfixes

Enhancements and bugfixes in the shared functionality.

Detailed list of changes:

• All: Added support for .NET Core on macOS.
• File Server: Fixed behavior of Rename operation in virtual file systems when the source file name and the target file name differ only in letter casing.
• File Server: Fixed propagation of the custom error from the SaveContent method in virtual file systems.
• File Server: Tweaked default set of Diffie-Hellman group exchange parameters in order to be compatibile with GlobalScape clients.
• File Server: Fixed non-working combination of legacy 'diffie-hellman-group14-sha1' key exchange cipher with 'hmac-sha2-512' MAC cipher.
• Networking: Closed ProxySocket objects throw more meaningful exception.
• SSH: Added support for additional formats to SshPublicKey.
• SSH: Fixed possible bug in SshPublicKey loading.
• SSH: Added SshPrivateKey.GetPrivateKeyInfo() method.
• TLS/SSL: Added SslSettings.​SslServerCertificateValidationOptions and SslCertificateValidationEventArgs.​Options properties.
• Cryptography: Added workaround for eToken CSP private key operations.
• Cryptography: Fixed possible 'Unexpected key algorithm' error in AsymmetricKeyAlgorithm.
• Cryptography: Fixed Certificate.​GetSignatureHashAlgorithm() for RSASSA-PSS certificates
• Cryptography: RSACryptoServiceProvider usability detection made more compatible.
• Cryptography: Fixed CertificateStore.Exists on .NET Core.
• Cryptography: Fixed Certificate.HasPrivateKey for non-silent keys.
• Cryptography: Fixed potential security vulnerability in RSAManaged class (proper padding check in signature verification).
• Common: Fixed compatibility with AWS Lambda.

2018 R1.1 #

(build 6690 from 2018-04-25)

New fully supported platform: .NET Core on Linux

This release adds full support for .NET Core 2.x on Linux.

Detailed list of changes:

• All: Added support for .NET Core on Linux.
• File Server: Optimized directory content enumeration on virtual file systems.
• File Server: Fixed handling of wildcard characters on virtual file systems.
• File Server: Fixed behavior of virtual file systems when opening file in 'OpenOrCreate' mode.
• File Server: Fixed handling of missing source file in Rename operations on virtual file systems.
• File Server: Fixed race condition in ServerSession.SendMessage method (only encountered on .NET Compact Framework).
• File Server: Fixed behavior of virtual file systems when opening file in 'Create' mode with 'Read' access.
• File Server: Tweaked socket binding on .NET Core on Linux.
• SSH: Fixed handling of invalid data packets claiming to contain more data than their payload length.
• TLS/SSL: Fixed error raising in TlsSocket's EndSend/EndReceive methods.
• Cryptography: Enhanced error message when trying to use signing-only RSA certificate for decryption.
• Cryptography: Fixed private key exporting on .NET Core on Linux.
• Cryptography: Fixed retrieval of certificate with bound keys from store on .NET Core on Linux.
• Cryptography: Fixed possible NullReferenceException in built-in custom certificate validator on .NET Compact Framework. Could occur using CRL validation.
• Cryptography: Fixed DSAManaged.ExportParameter method that failed to export parameters with missing Seed.
• Cryptography: Added CertificateEngine.​BuildChain(Certificate) method.
• Cryptography: Current CertificateEngine's BuildChain method is now used in CMS (PKCS #7) SignedData and EnvelopedData.
• Cryptography: Added Certificate.Tag property to make it possible to associate custom objects with a particular Certificate instance.
• Cryptography: Enhanced logging in built-in custom certificate validator on .NET Compact Framework.

2018 R1 #

(build 6666 from 2018-04-01)

Enhancements and bugfixes

Enhancements, bugfixes and workarounds in virtual file system infrastructure and other areas.

Detailed list of changes:

• File Server: Fixed logging of cipher mismatch errors.
• File Server: Fixed logging of 'too many authentication attempts' error.
• File Server: Fixed behavior of 'cp' command in virtual shell.
• File Server: Retired FileServerAction.CopyFile and Rename actions (now reported as sequence of simpler actions).
• File Server: Fixed handling of custom exception in virtual file system providers.
• File Server: Added SshConsole.HasPseudoTerminal property.
• File Server: Added FileServer.​Settings.​ForceShellWelcomeMessage property.
• File Server: Treat both '\r' and '\n' as 'Enter' in terminal-less shell.
• File Server: Fixed incomplete (un)aliasing of virtual file system paths and related problems with Move operation.
• File Server: Disallowed non-empty directory removal in virtual file system.
• File Server: Added workaround for confusing sharing violation error when deleting non-empty directory on Windows Embedded Compact 7.
• File Server: Fixed buffer size in directory enumerator on .NET Compact Framework (potentially causing memory corruption).
• File Server: Fixed problems with incomplete enumeration of nodes in linked directories in MountCapableFileSystemProvider.
• File Server: Fixed handling of already-existent files in Rename/Move/Copy operations on virtual file systems.
• File Server: Added workaround for known issue in .NET Framework 4.5 ('Operation could destabilize the runtime' error).
• File Server: Added TunnelRequestedEventArgs.Session property.
• File Server: Added missing '.' and '..' entries when enumerating virtual file system directories.
• File Server: Fixed access mode when opening a files in virtual file system.
• File Server: Fixed unhelpful error message when creating a directory that already exists in a virtual file system.
• SSH: Added support for AES/GCM ciphers ('aes128-gcm@openssh.com' and 'aes256-gcm@openssh.com') to SSH client.
• SSH: Added support for EtM MAC ciphers ('hmac-sha2-256-etm@openssh.com' and 'hmac-sha2-512-etm@openssh.com') to SSH client.
• TLS/SSL: Log deprecation warning when using SSL 3.0, which is disabled by default and should no longer be used at all.
• TLS/SSL: Added SslSettings.​SslRenegotiationExtensionEnabled option.
• TLS/SSL: Added SslSettings.​SslServerNameIndicationEnabled option.
• Cryptography: Added CryptographicCollection<T> as a base for cryptographic collection classes.
• Cryptography: Fixed possible NullReferenceException inCertificateRevocationList.​GetRevocationReason() method.
• Cryptography: Fixed PFX saving on Mono.
• Cryptography: Fixed "Unable to load DLL 'Bcrypt.dll'" error on Linux with .NET Core.
• Cryptography: Added EnhancedCertificateEngine to .NET Compact Framework version to make it possible to supply custom root certification authorities.
• Common: Enabled Certificate/​CertificateChain.​LoadPfx with AlwaysCng option on .NET Compact Framework 3.9.
• Common: Fixed rare race condition in possibly leading to NullReferenceException on .NET Core and UWP platforms.
• Common: Fixed COMException in CertificateChain.BuildFrom method on experimental UWP platform.
• Common: Built-in custom certificate validator on .NET CF no longer unnecessarily validates signature of root CA certificates that are trusted by the OS.

2017 R6.3 #

(build 6586 from 2018-01-11)

Maintenance release

This is a maintenance release with enhancements in the shared functionality.

Detailed list of changes:

• Cryptography: Added support for RSAES-OAEP with input parameter (label).
• Cryptography: Added support for RSAES-OAEP with mismatched hash algorithms.
• Cryptography: Fixed initialization of EncryptionAlgorithm property in MailMessage.Recipients collection items.
• Cryptography: Added support for RSASSA-PSS with mismatched hash algorithms.
• Cryptography: Fixed CNG private key conversion workaround.

2017 R6.2 #

(build 6565 from 2017-12-21)

Faster AES on Windows

Rebex libraries now use Windows CNG for AES symmetric encryption algorithm when available. CNG implementation of AES is faster and takes advantage of AES-NI instructions.

Detailed list of changes:

• File Server: Added workaround for content streams that do not support seeking beyond the end-of-stream.
• File Server: A meaningful error message is now reported when a virtual file system operation is canceled in the preview event.
• File Server: Fixed locking of FileServer.Keys collection.
• File Server: Added Action property to FileServer.PathAccessAuthorization event arguments.
• File Server: Messages from FileSystemException error now propagate to the SFTP subsystem.
• File Server: Fixed unintended reset of ServerSession.Current when raising FileServer events.
• File Server: Fixed wrong target path passed to virtual file system Move method.
• Networking: ProxySocket constructor requires a connected socket now.
• SSH: Added SshParameters.​UseLegacyGroupExchange option to make it possible to force using legacy or standard form of SSH Diffie-Hellman group exchange packet.
• SSH: Enhanced legacy group exchange autodetection.
• TLS/SSL: Fixed handling of duplicate suites in ClientHello packets.
• Cryptography: Added CertificateChain.LoadDer method to load a chain of Base64-encoded certificates.
• Cryptography: Fast CNG implementation of AES (which takes advantage of AES-NI instructions) is used when available.
• Cryptography: Added workaround for broken X509Certificate.GetPublicKey() on Mono 5.4.
• Cryptography: Added a workaround for GPG's gpgsm utility that required some SignedData fields to be DER-encoded.

2017 R6.1 #

(build 6534 from 2017-11-20)

Maintenance release

This is a maintenance release with improvements, bugfixes or workarounds in the shared functionality.

Detailed list of changes:

• SSH: Added SshPublicKey.LoadPublicKeys method that supports loading OpenSSH's 'authorized_keys' files.
• Cryptography: Enhanced custom CRL downloader for .NET Compact Framework to handle all 3xx redirect codes.
• Cryptography: Enhanced Certificate.LoadDer to handle files with multiple certificates (loads the first one).
• Cryptography: Enabled usage of MS CNG API in .NET Compact Framework 3.9 edition on Windows Embedded Compact 2013 when appropriate.
• Cryptography: Fixed detection of AES/GCM support.
• Cryptography: Fixed detection of native Brainpool and secp256k1 support.
• Cryptography: Added 'params' to CertificateInfo.​SetExtendedUsave/​SetAlternativeHostnames methods.
• Cryptography: Fixed null handling in CertificateInfo.MailAddress.
• Cryptography: Fixed empty block processing in AES/GCM.
• Common: Added workaround for broken Encoding.ASCII encoder on legacy Mono platforms.
• Common: Enhanced SSPI error reporting.
• Common: Fixed platform info in logs on macOS.

2017 R6 #

(build 6508 from 2017-10-25)

Maintenance release

This is a maintenance release with several improvements, bugfixes and workarounds.

Detailed list of changes:

• All: Added support for DSA key generation on .NET Core on Windows.
• File Server: Fixed virtual root handling for root-based paths.
• File Server: VfsContentStream marks content as 'dirty' when its SetLength method is called as well.
• Networking: Fixed PortRange binding (an issue introduced in previous release).
• Networking: Fixed ReceiveBufferSize/SendBufferSize propagation (an issue introduced in previous release). This was observed to cause slowdown on Windows platform in some scenarios.
• Networking: Fixed handling of IP-based host names in proxy name resolving routine (an issue introduced in previous release).
• TLS/SSL: Added support for AES/GCM to TLS.
• TLS/SSL: Added TlsCipherSuite.Weak enum.
• Cryptography: Added support for RSAES-OAEP encryption to EnvelopedData/RecipientInfo objects (CMS / PKCS #7).
• Cryptography: Added support for RSAES-OAEP encryption to Encrypt/Decrypt methods in Certificate and AsymmetricKeyAlgorithm classes.
• Cryptography: Added support for DSA key generation on .NET Core 1.1 on Windows.
• Cryptography: Added support for RSASSA-PSS signatures to SignMessage/VerifyMessage methods in Certificate and AsymmetricKeyAlgorithm classes.
• Cryptography: Enhanced environment info logging.
• Cryptography: Fixed KeySize property of RSAManaged and DSAManaged to return the proper size for key sizes that are not evenly divisible by 8.
• Cryptography: Added support for RSASSA-PSS signatures to SignedData/SignerInfo objects (CMS / PKCS #7).
• Cryptography: Added support for legacy MD4 algorithm.
• Cryptography: Fixed saving of Brainpool keys (used wrong OID).
• Cryptography: Fixed handling of ED25519 keys in PrivateKeyInfo.
• Cryptography: Fixed CertificateStore private key saving on Mono.
• Common: Environment info is now logged when creating an instance of FileLogWriter.

2017 R5 #

(build 6461 from 2017-09-08)

New fully supported platforms: .NET Core 1.1 and 2.0 on Windows

This release adds full support for .NET Core 2.0 and 1.1 on Windows. Support for .NET Core on Linux and macOS is still experimental.

Support for .NET Standard 1.5, 1.6 and 2.0 (on .NET Core 1.1 and 2.0)

All Rebex libraries support .NET Standard 1.5, 1.6 and 2.0 on .NET Core 1.1 and 2.0. Support for other platforms (such as .NET Standard on .NET 4.6.x or higher) is still experimental.

Detailed list of changes:

• All: Added support for .NET Core 1.1 and 2.0 on Windows.
• File Server: Fixed unwanted pseudo-link persistence in MountCapableFileSystemProvider.
• File Server: Fixed a possible temporary deadlock in SFTP subsystem triggered when channel's receive buffers on both client and server got full at the same time.
• Networking: Added support for "http://" URLs in Proxy.Host.
• Cryptography: Added HTTP redirect handling to CRL downloader on .NET Compact Framework.
• Cryptography: Added workaround to enable SHA-2 on legacy operating systems (such as pre-SP3 Windows XP).
• Cryptography: Using ASN.1 GeneralizedTime for dates greater than 2050.
• Cryptography: Enhanced logging of some SSPI errors.
• Cryptography: Added workaround for invalid or empty HTTP header names.
• Common: Enabled SHA-2 support workaround for legacy RSA providers.
• Common: Using custom IBM 437 encoding on .NET Compact Framework.

2017 R4.1 #

(build 6426 from 2017-08-04)

Maintenance release

This is a maintenance release with several improvements, bugfixes and workarounds in the shared functionality.

Detailed list of changes:

• Cryptography: Enhanced RSAES-OAEP support.
• Cryptography: Added CertificateStore.Add method (replacement for deprecated CertificateStore.AddCertificate method).
• Cryptography: Added KeySetOptions.PreferCng and KeySetOptions.AlwaysCng options.
• Cryptography: Fixed AsymmetricKeyAlgorithm.Dispose method.
• Cryptography: Fixed AsymmetricKeyAlgorithm.CreateFrom method (always honors the ownsAlgorithm argument now).

2017 R4 #

(build 6391 from 2017-06-30)

Custom file system support

Rebex File Server now features a rich custom file system provider API. This can be used to implement virtual file systems, or custom file systems that store data in a database, in the cloud, or elsewhere. Additionally, the built-in mount-capable virtual file system provider makes it possible to construct virtual file systems composed from multiple unrelated providers.

Support for CNG Key Storage Providers

Rebex Certificate class now fully supports RSA, DSA and ECDSA private keys stored in Windows CNG Key Storage Providers.

Detailed list of changes:

• All: Deprecated .NET Compact Framework 2.0, Windows (Store) 8.0 and Windows (Store/Phone) 8.1 platforms.
• All: Lots of improvements in experimental .NET Core / .NET Standard edition.
• File Server: Added Rebex.FileSystem assembly with support for custom file system providers.
• File Server: Added Session property to server event arguments.
• File Server: Added GetInputStream/​GetOutputStream/​GetErrorStream methods to SshConsole. This makes it possible to implement advanced custom commands.
• File Server: Added Unix-like 'cp' (copy) command to virtual shell.
• File Server: Enhanced handling of ShellCommand event handler errors.
• File Server: Added DisconnectedEventArgs.User property.
• File Server: Implemented IDisposable in FileServer/Server classes.
• File Server: Enhanced logging of info requests for non-existent items.
• File Server: Added ServerSession.GetCurrent() static method.
• File Server: Added FileServer.​Settings.​GetItemInfoRequiresListPermission option to make it possible to specify whether item info retrieval requires List permission or Read permission.
• File Server: Enhanced handling of failed channel requests.
• File Server: Virtual root accessibility is checked before initializing the SFTP subsystem now.
• File Server: Added workaround for wrong error code reported as last error when deleting non-existent file.
• SSH: Added SshParameters.CompressionLevel option to make it possible to specify the desired compression level for SSH.
• SSH: Deprecated SshPrivateKey.CreateSignature, VerifySignature and an old variant of the SshPrivateKey.Save method.
• SSH: Added SshPublicKey.GetPublicKeyInfo() method.
• SSH: Added SshException.GetServerInfo() method to make it possible to determine lists of ciphers supported by the server when SSH negotiation fails.
• Cryptography: Added support for certificates with private keys stored in CNG Key Storage Providers.
• Cryptography: Compatibility enhancements in Certificate public/private key operations and AsymmetricKeyAlgorithm class.
• Cryptography: Added Certificate.GetPublicKeyInfo() method.
• Cryptography: Fixed PublicKeyInfo.GetKeySize() method that used to throw an exception for ECDSA and ED keys.
• Cryptography: Added native support for secp256k1, Brainpool P-256 R1, P-384 R1 and P-512 R1 on Windows 10 and Windows Server 2016.
• Cryptography: Fixed default hash algorithm detection in SignMessage/VerifyMessage methods in Certificate and AsymmetricKeyAlgorithm classes.
• Cryptography: Experimental support for CMS (PKCS #7) decryption with RSA/OAEP/SHA-1 (RSAES-OAEP defined by RFC 3447).
• Cryptography: Fixed 'Unexpected PFX length' error when exporting 4096-bit RSA certificates into PFX/P12 file.

2017 R3 #

(build 6339 from 2017-05-09)

NuGet packages

Rebex libraries just got official NuGet packages!

If you have an active subscription, you will get NuGet packages as part of Rebex libraries. These are supposed to be added to your private NuGet repository.

Rebex packages are available at NuGet.org as well.

Experimental support for .NET Standard 1.5 and NET Core

This release adds experimental support for .NET Core (or rather .NET Standard 1.5/1.6) to all Rebex libraries.

In addition to .NET Core on Windows, Linux and macOS, .NET Standard edition of Rebex libraries can be used on any platform with .NET Standard 1.5 support. This currently includes .NET 4.6.2 and .NET 4.7, and hopefully other platforms soon.

Please note that 'experimental' support means that this edition has not yet reached the 'mainstream' support phase, and the API is subject to change. Any feedback is greatly appreciated.

Support for .NET Framework 4.7

.NET Framework 4.7 is a fully supported platform.

Detailed list of changes:

• All: Added NuGet packages.
• All: Added experimental support for .NET Core and .NET Standard 1.5.
• All: Added workaround for a breaking change in Exception.Data on recent Xamarin.Android.
• All: Added support for .NET Framework 4.7.
• File Server: Fixed unreadable packet names in some exception messages.
• File Server: Added support for single quotes in virtual shell.
• Cryptography: Enhanced error messages in AsymmetricKeyAlgorithm.
• Cryptography: Custom certificate validator now behaves like MS CryptoAPI validator when dealing with RSA key sizes shorter than 1024 bits; MD5 signature hash algorithm is always considered to be weak for non-root certificates.
• Cryptography: Added support for .PFX/.P12 saving on .NET Compact Framework (requires Windows CE 5.0 or later).
• Common: Fixed incorrect handling of CNG RSA keys.

2017 R2 #

(build 6291 from 2017-03-22)

SSH client authentication using RSA with SHA-2

All Rebex libraries utilizing our SSH library now support client public/private key authentication based on RSA with SHA-2:

• rsa-sha2-256
• rsa-sha2-512
• ssh-rsa-sha256@ssh.com

Support for Visual Studio 2017

All Rebex libraries are now fully supported in Microsoft Visual Studio 2017. Older Visual Studio versions (2008 and higher) and .NET Framework versions (2.0 and higher) are still supported as well.

Minor ISocket API changes

Legacy parts of ISocket interface were moved into ISocketExt interface. If you implemented a custom transport layer using the ISocket API, make sure to implement ISocketExt instead when upgrading to this release.

Seldom-used static methods in CryptoHelper class were removed. If you need any of them, please let us know.

Detailed list of changes:

• All: Mono 2.10 is no longer supported. (Mono 3.x and 4.x still supported.)
• File Server: Fixed an issue in renegotiation that caused connection failure in some scenarios.
• File Server: Fixed incompatibilities in rsa-sha2-256/rsa-sha2-512 signature format.
• File Server: Added support for client key authentication using 'rsa-sha2-256', 'rsa-sha2-512' and 'ssh-rsa-sha256@ssh.com' algorithms.
• Networking: Added logging of environment and platform information.
• Networking: Enhanced target address logging when connecting.
• Networking: HTTP core provides better inner exceptions on errors.
• Networking: Legacy members of custom transport layer API moved from ISocket to ISocketExt.
• Networking: Fixed ProxySocket.Connect(...) on Mono 2.10.
• SSH: Enhanced cipher mismatch error reporting during SSH negotiation to produce informative error messages.
• SSH: Added GetSupportedMacAlgorithms/​GetSupportedEncryptionAlgorithms/​GetSupportedKeyExchangeAlgorithms static methods to SshParameters.
• SSH: Added support for client key authentication using 'rsa-sha2-256', 'rsa-sha2-512' and 'ssh-rsa-sha256@ssh.com' algorithms.
• SSH: Added OpenSSH-style fingerprint support to SshFingerprint class.
• TLS/SSL: Added support for Elliptic Curve DSA to TLS 1.2/1.1/1.0.
• TLS/SSL: Fixed unexpected connection closure handling in TlsSocket.
• TLS/SSL: Fixed handling of Timeout value in TlsSocket.Receive.
• Cryptography: Added support for Elliptic Curve DSA to Certificate/​CertificateChain/​CertificateIssuer classes.
• Cryptography: SignMessage/VerifyMessage methods added to AsymmetricKeyAlgorithm.
• Cryptography: Renamed KeyDerivationOptions class to KeyDerivationParameters.
• Cryptography: Removed seldom-used static methods from CryptoHelper.
• Cryptography: CertificateIssuer class made available on .NET Compact Framework.
• Cryptography: Fixed TLS 1.0/1.1 on FIPS-only Windows with disabled UseFipsAlgorithmsOnly.
• Cryptography: Enhanced CertificateIssuer API.
• Cryptography: Fixed PrivateKeyInfo.KeyAlgorithm that returned non-standard values for some ECDSA keys.
• Cryptography: Fixed handling of padding in ECDSA private keys stored using the new OpenSSH format.
• Cryptography: Fixed weak algorithm detection in .NET Compact Framework custom certificate verifier.

2017 R1 #

(build 6249 from 2017-02-08)

Support for the new OpenSSH key format

Our SSH based libraries can now save private keys using the new OpenSSH key format (Base64-encoded keys with "BEGIN OPENSSH PRIVATE KEY" header).

Detailed list of changes:

• File Server: Added FileServer.​Settings.​ReceiveBufferSize and SendBufferSize properties.
• File Server: Fixed handling of several control characters in virtual shell.
• Networking: Added workaround for a breaking change in Exception.Data on recent Xamarin.iOS.
• Networking: TlsSocket.Timeout modifies the underlying ISocket.Timeout as well now.
• Networking: Slightly enhanced certificate rejection reason reporting in TLS.
• Networking: Enhanced ProxySocket connection initialization.
• SSH: Added EnsureKeyAcceptable option that instructs SSH client to announce public key to the server before performing key authentication.
• SSH: Added support for saving private keys in new OpenSSH key format (Base64-encoded keys with "BEGIN OPENSSH PRIVATE KEY" header).
• SSH: Added support for "rsa-sha2-256" and "rsa-sha2-512" host key algorithms.
• SSH: Added support for "diffie-hellman-group14-sha256", "diffie-hellman-group15-sha512" and "diffie-hellman-group16-sha512" key exchange algorithms.
• TLS/SSL: Added support for Renegotiation Indication Extension (RFC 5746).
• TLS/SSL: Preferred TLS/SSL ciphers can be now defined (using TlsParameters.SetPreferredSuites method).
• TLS/SSL: Added check for private key accessibility when starting server-side TLS.
• Cryptography: Added support for ValidationOptions.UseCacheOnly on .NET CF.
• Cryptography: Substantially optimized CRL parsing code used by enhanced certificate validator on .NET Compact Framework.

2016 R3 #

(build 6198 from 2016-12-19)

Elliptic curve cryptography in SSH

All Rebex libraries utilizing our SSH library now support SSH key exchange algorithms based on Elliptic Curve Diffie-Hellman (ECDH) algorithm and SSH host key algorithms based on Elliptic Curve DSA (ECDSA) and Edwards-curve DSA (EdDSA) algorithms:

• ecdh-sha2-nistp256
• ecdh-sha2-nistp384
• ecdh-sha2-nistp521
• curve25519-sha256@libssh.org
• ecdsa-sha2-nistp256
• ecdsa-sha2-nistp384
• ecdsa-sha2-nistp521
• ssh-ed25519

Please note that external plugins might be needed for some of those algorithms or curves on some platforms.

New OpenSSH key format support

SshPrivateKey and PrivateKeyInfo objects can read server and client keys utilizing the new OpenSSH key format (Base64-encoded keys with "BEGIN OPENSSH PRIVATE KEY" header). This format is usually used to store ED25519 or ECDSA keys.

Fine-tuning enabled ciphers in SSH

Previously, SshParameters only made it possible to enable/disable groups of ciphers. Now, it's possible to fine-tune the list of supported algorithms, including their preferred order (client-side only) using SetKeyExchangeAlgorithms, SetHostKeyAlgorithms, SetEncryptionAlgorithms and SetMacAlgorithms methods. Please note that KeyExchangeAlgorithms, HostKeyAlgorithms, EncryptionAlgorithms and MacAlgorithms properties still apply - a cipher is only used when it is enabled by both the method and property.

Disabled weak algorithms in SSH

Several legacy ciphers are now disabled by default: diffie-hellman-group1-sha1, blowfish-ctr, blowfish-cbc, arcfour256, arcfour128, arcfour. Use SshParameters.KeyExchangeAlgorithms and SshParameters.EncryptionAlgorithms to enable them.

Weak RSA server host keys shorter than 1024 bits are now rejected by default. Use SshParameters.MinimumRsaKeySize property to specify a custom key size.

Detailed list of changes:

• File Server: Renamed FileServerUser constructor's physicalRootPath argument to virtualRootPath.
• File Server: Added support for "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521" and "curve25519-sha256@libssh.org" key exchange algorithms (plugins needed to enable them).
• File Server: Proper maximum packet size used when sending channel data (instead of hardcoded value).
• File Server: Fixed rename operation that used to fail for directories located in the physical disk's root directory.
• File Server: Fixed a bug that could cause timeout and session failure during SSH session renegotiation.
• File Server: Added support for "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521" and "ssh-ed25519" host key algorithms (plugins might be needed on some platforms).
• File Server: Both RSA and DSA certificates can be used as host key at the same time.
• Networking: Enhanced and optimized HTTP/HTTPS client core.
• Networking: Connect/Listen methods on ProxySocket/TlsSocket objects now throw an exception when called twice on the same socket.
• Networking: Added SocketInformation constructor.
• SSH: Added support for "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521" and "curve25519-sha256@libssh.org" key exchange algorithms (plugins might be needed on some platforms).
• SSH: Added support for saving keys in new OpenSSH key format (Base64-encoded keys with "BEGIN OPENSSH PRIVATE KEY" header).
• SSH: Added SetKeyExchangeAlgorithms, SetHostKeyAlgorithms, SetMacAlgorithms methods to SshParameters object to make it possible to fine-tune the list of enabled SSH ciphers.
• SSH: Legacy Diffie-Hellman group exchange is only used with legacy SSH servers.
• SSH: Added SshSession.ServerInfo property to make it possible to determine ciphers supported by the SSH server.
• SSH: Added SshPublicKey.KeySize property.
• SSH: Added SshParameters.MinimumRsaKeySize property specifying to connect only to SSH servers with RSA server key of given size or higher.
• SSH: Added support for "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521" and "ssh-ed25519" host key algorithms (plugins might be needed on some platforms).
• SSH: Disabled weak SSH ciphers by default (they can still be enabled explicitly).
• SSH: Check availability of associated private key when adding a certificate-based server host key.
• SSH: Fixed possible NullReferenceException when closing SSH client from another thread just before receiving data.
• TLS/SSL: Added support for Elliptic-Curve based TLS ciphers (TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA) with NIST P-256/P-384/P-521, Curve 25519 and Brainpool P256R1/P384R1/P512R1 curves. Plugins are needed for some of those.
• TLS/SSL: Server name is now passed to TLS server during negotiation (use TlsParameters.CommonName to override it).
• TLS/SSL: Fixed TlsCipherSuite.All to include all recently added cipher suites.
• TLS/SSL: All legacy 'EXPORT1024' ciphers are now prohibited by default in addition to already-prohibited 'EXPORT' ciphers (unless AllowVulnerableSuites option is enabled).
• TLS/SSL: Fixed issues with some legacy TLS/SSL ciphers (all of them were already disabled by default).
• TLS/SSL: Enhanced error reporting in server-side TLS/SSL library.
• Cryptography: Improved ASN.1 time node parser.
• Cryptography: Added support for certificate validation on Universal Windows Platform.
• Cryptography: Added custom X.509 certificate validator for .NET Compact Framework with full SHA-2 support on all platforms.
• Cryptography: Fixed parsing of 'Intended Usage' extension when 'Decipher Only' was specified.
• Cryptography: Added static Create method to SHA256Managed/​SHA384Managed/​SHA512Managed classes on .NET Compact Framework.
• Cryptography: ValidationResult.ErrorCode deprecated and replaced with NativeErrorCode.
• Cryptography: Optimized memory usage in CMS/PKCS #7 (SingedData/EnvelopedData classes).
• Cryptography: Added missing argument checks to CertificateIssuer methods.
• Cryptography: Added support for Base64-encoded files with CRLF end-of-line sequences to CertificateChain.LoadP7b method.
• Cryptography: Fixed HMAC calculation based on SHA-384 and SHA-512 on NET Compact Framework and Mono platforms.
• Cryptography: Added Rebex.​Security.​Certificates.​CertificateEngine class to make it possible to implement custom X.509 chain building and validation engines.
• Common: Added ConsoleLogWriter for Xamarin platforms.
• Common: Added Rebex.TeeLogWriter class that makes it possible to log to multiple log writers.
• Common: Added LocalItem.GetChecksum methods and related types.

2016 R2.2 #

(build 6083 from 2016-08-26)

Maintenance release

This update brings several improvements, workarounds and bugfixes.

Detailed list of changes:

• File Server: Fixed FileUploaded/FileDownloaded events that used to be wrongly called on session failure.
• SSH: Enhanced handling of errors in FingerprintCheck event handlers.
• TLS/SSL: Fixed a rare issue in abbreviated TLS/SSL negotiation handling.
• Cryptography: Added CheckCertificate/​GetIssuingDistributionPoint methods to CertificateRevocationList class and ValidateRevocationList method to Certificate class.
• Cryptography: Enhanced SHA-2 support check on .NET Compact Framework.
• Cryptography: Fixed SHA-2 support in AsymmetricKeyAlgorithm.SignHash on Windows Server 2008 (and possibly other old platforms).
• Common: Added workaround for broken FileStream.SetLength on some .NET Compact Framework platforms.

2016 R2.1 #

(build 6054 from 2016-07-28)

Fixed RSA-based session negotiation

In 2016 R2, File Server always attempted to use RSAManaged to create an RSA signature instead of using RSACryptoServiceProvider whenever possible.

Experimental support for Universal Windows Platform

Rebex File Server binaries for Universal Windows Platform are now available. Supported platforms include Windows 10, Windows 10 Mobile, Windows 10 IoT and possibly Xbox One.

Detailed list of changes:

• File Server: Added FileServer.Settings.ShowHiddenItems option that makes it possible to show file system items with 'hidden' flag from directory listings.
• File Server: Added experimental File Server binaries for Universal Windows Platform.
• File Server: Added support for extremely verbose incoming packet logging (log level 0).
• File Server: Fixed handling of connection protocol packets received during renegotiation.
• Networking: Fixed ProxySocket.ToEndPoint to throw a more meaningful exception for entries with no IP addresses.
• TLS/SSL: Fixed unreadable TLS debug log messages on Xamarin platforms.
• TLS/SSL: Added workarounds for bugs in Microsoft Schannel implementation of DHE_RSA_* ciphers related to incorrect padding processing.
• Cryptography: Fixed AsymmetricKeyAlgorithm.SignHash (in 2016 R2, it falls back to RSAManaged without trying to use RSACryptoServiceProvider first).
• Cryptography: Fixed CertificateIssuer.​IssueRevocationList method that ignored signatureHashAlgorithm argument and always used SHA-1.
• Common: FileLogWriter on Windows Store 8.x / Universal Windows Platform is now thread-safe.
• Common: Fixed LocalItem(string) constructor on Windows Store 8.x / Universal Windows Platform.
• Common: Added workaround for broken handling of surrogate pairs when converting to "iso-8859-1" using System.Text.Encoding on Mono 4.x.

2016 R2 #

(build 6026 from 2016-06-30)

Support for Xamarin June 2016 Update

June 2016 update of Xamarin.iOS/Xamarin.Android/Xamarin.Mac introduced a breaking change in Mono.Security API that broke compatibility with Rebex libraries. This issue has been solved in this release.

SHA-2 for all supported .NET Compact Framework platforms

SHA-1 is currently being deprecated (applies to X.509 certificates, TLS/SSL and SSH), which poses a problem for legacy .NET Compact Framework platforms based on editions of Windows CE with no native SHA-2 support. To make solutions for these platforms compatible with current TLS/SSL and SSH serves, we added a custom implementation of SHA-2 for these legacy platforms.

Additional SSH host key algorithms

Support for 'x509v3-sign-dss', 'ssh-rsa-sha256@ssh.com' and 'x509v3-sign-rsa-sha256@ssh.com' host key algorithms has been added to SFTP, SCP, SSH and File Server libraries.

Detailed list of changes:

• File Server: Enhanced error reporting when trying to delete non-empty directories.
• File Server: Fixed data buffering in SFTP subsystem.
• File Server: Ssh object now properly closes tunnel listeners when disposed.
• File Server: Added MaxSessionTransferredBytes and MaxSessionDuration settings to specify when to trigger session renegotiation.
• File Server: Added FileServer.Settings.UseLargeBuffers option.
• File Server: Added support for additional server authentication algorithms ('x509v3-sign-dss', 'ssh-rsa-sha256@ssh.com' and 'x509v3-sign-rsa-sha256@ssh.com').
• File Server: Fixed compatibility with Bitvise SSH Client related to text mode.
• File Server: Fixed error handling in SSH tunnel starter.
• File Server: Fixed possible NullReferenceException on connection failure.
• File Server: Added ClientSoftwareIdentifier to PreAuthenticationEventArgs and AuthenticationEventArgs.
• Networking: Increased default receive buffer size on Windows 8 and higher. Added related Proxy properties to make this configurable.
• Networking: ProxySocket object's Connect method now uses the timeout value specified by the Timeout property.
• SSH: Added support for additional server authentication algorithms ('x509v3-sign-dss', 'ssh-rsa-sha256@ssh.com' and 'x509v3-sign-rsa-sha256@ssh.com').
• SSH: Disabled hmac-sha96 SSH cipher in FIPS mode (it's not compliant).
• SSH: Fixed error handling in queued background calls (mostly applies to session renegotiation).
• SSH: Fixed renegotiation handling to allow renegotiation while authenticating.
• SSH: Fixed DSA client certificate authentication.
• SSH: Enhanced interactive authentication support to handle uppercase password prompts.
• TLS/SSL: Enhanced SHA-2 support for .NET Compact Framework. SHA-256, SHA-384 and SHA-512 are now supported even on platforms with no native SHA-2 support.
• TLS/SSL: Added Settings.SslSession property to allow resuming specific TLS/SSL sessions.
• TLS/SSL: Fixed record layer 'protocol version' handling.
• TLS/SSL: Enhanced Diffie-Hellman key exchange logging.
• Cryptography: Fixed detection of native SHA-2 support in .NET Compact Framework version.
• Cryptography: Added support for more variants of OpenSSL/OpenSSH (SSLeay) key files.
• Cryptography: Fixed Certificate.Associate to work with DSA keys.
• Cryptography: Added CrlNumber property to CertificateRevocationList object.
• Cryptography: Added support for SHA-2 certificates to Certificate.VerifyHash in .NET Framework 2.0 on Windows with FIPS-compliant mode enabled.
• Cryptography: Certificate.LoadPfx and CertificateChain.LoadPfx methods now specify Exportable options by default (in addition to UserKeySet).
• Cryptography: Added workaround for RSA implementations that reject rare signatures shorter than the key size.
• Common: Enhanced SSPI error messages.
• Common: Fixed LogWriterBase.Level default value.
• Common: Fixed compatibility issue in Xamarin edition (caused by a breaking change in June 2016 update of Xamarin).

2016 R1.1 #

(build 5885 from 2016-02-10)

Experimental assemblies for Xamarin.Mac

Added experimental binaries of most Rebex libraries (FTP/SSL, SFTP, File Server, Secure Mail, ZIP, Time, Security) for Xamarin.Mac platforms. They are suitable for targeting Xamarin.Mac Mobile Framework and Xamarin.Mac .NET 4.5 Framework projects.

Maintenance release

Experimental binaries of most Rebex libraries (FTP/SSL, SFTP, File Server, Secure Mail, ZIP, Time, Security) for the Xamarin.Mac platform are now available. They are suitable for targeting both Xamarin.Mac Mobile and Xamarin.Mac .NET 4.5 Framework projects.

Maintenance release

This release includes several hotfixes.

Detailed list of changes:

• SSH: Fixed seldom-used SshSession.Connect(string, int) method that was freezing since 2016 R1.
• SSH: Added workaround for older version of Bitvise server that don't properly handle SSH channel closing.
• SSH: Fixed handling of multi-line SSH banner messages.
• SSH: Fixed a bug in SSH channel window size adjustment.
• SSH: Fixed potential NullReferenceException error in SshSession.Dispose method.
• TLS/SSL: Disabled any usage of MD5 in TLS 1.2 to prevent SLOTH attacks.

2016 R1 #

(build 5855 from 2016-01-11)

SSH tunneling (port forwarding)

Supports for outgoing SSH tunnels (port forwarding) was added.

Mitigation of Logjam attacks

Check for minimum allowed Diffie-Hellman key size (1024 bits) has been added to SSH and TLS/SSL to mitigate Logjam attacks. The minimum value can be changes using Settings.SslMinimumDiffieHellmanKeySize or Settings.SshParameters.MinimumDiffieHellmanKeySize.

File upload/download events in File Server

Added FileUploaded and FileDownloaded events to make it easier to track uploads and downloads.

Server certificate authentication in SSH

Rebex SFTP, Terminal Emulation and File Server now support X.509 certificate host key algorithm, making it possible to authenticate servers using a certificate instead of public key.

Enhanced virtual shell support

File Server's virtual shell infrastructure offers Empty shell in addition to Scp shell. It provides no predefined commands (with the exception of exit), making it simple to provide a custom set of commands instead.

Detailed list of changes:

• All: Added workaround for Xamarin.Android whose Dns.GetHostEntry resolves 'localhost' to device's external IP address.
• All: Rebex assemblies are now signed with SHA-256 signatures in addition to legacy SHA-1 signatures.
• File Server: Added port forwarding (TCP tunneling) support.
• File Server: Enhanced logging of handle-based file system operations (such as closing a file).
• File Server: IsRunning property added to Server/FileServer objects.
• File Server: Added FileUploaded/FileDownloaded events.
• File Server: Starting a server with no bindings now triggers an error.
• File Server: Fixed wrong session ID in SFTP error log entries.
• File Server: Fixed handling of empty folders on Windows CE.
• File Server: Fixed bad P/Invoke declaration (applies to Windows platforms).
• File Server: Enhanced error reporting in SFTP and SCP and fixed several wrong error codes.
• File Server: Fixed file delete operation that used to report success when deleting non-existent file on non-Windows platforms.
• File Server: Fixed compatibility issues with libssh2.
• File Server: Added proper data window size checks.
• File Server: Added workaround for wrong error code reported as last error when deleting non-existent file.
• File Server: Added workaround for Open with Create+Read in .NET-based virtual file system.
• File Server: Fixed Unbind method that occasionally triggered an error.
• File Server: Added FileServerProtocol.Shell (replaces FileServerProtocol.Scp). Makes it possible to choose between SCP shell and empty shell when constructing a user object.
• File Server: Enhanced error handling during initialization. Early closed connections no longer leave the server in an unusable state.
• File Server: Added workaround for buggy (or malicious) clients that send incomplete disconnect requests.
• File Server: Added logging of successful and failed authentication attempts.
• File Server: Added workaround for Windows CE with missing Enhanced DSS and Diffie-Hellman Cryptographic Provider (managed and slow implementation of Diffie-Hellman is used in this case).
• File Server: Fixed FileServer constructor (used to fail when default charset was multi-byte but not UTF-8).
• File Server: Unified ShellCommandEventArgs.User and SshConsole.User types.
• File Server: Added support for certificate-based server authentication (using 'x509v3-sign-rsa algorithm').
• File Server: Enhanced key negotiation error logging.
• File Server: Added workaround for Xamarin.Android where it was possible to open a non-existing directory.
• Networking: Fixed a bug in SOCKS4/SOCKS5 response reading code that triggered an infinite loop with buggy proxy servers.
• Networking: Enhanced DNS resolution error messages.
• SSH: Enhanced interactive authentication support to make it possible to use AuthenticationRequest event to ask for username and password.
• SSH: Enhanced rejected authentication logging and error reporting.
• SSH: Fixed compatibility with old versions of OpenSSH (2 and 3).
• SSH: Fixed a bug that could cause a deadlock in packet sending routine.
• SSH: Added SshParameters.​MinimumDiffieHellmanKeySize value (set to 1024 by default to mitigate Logjam attacks).
• SSH: SshPrivateKey constructor's 'password' argument made optional.
• SSH: No exception is thrown when the server aborts connection instead of closing it (unless a packet is being received).
• SSH: Enhanced 'no common algorithms' error message.
• SSH: Refactored SSH core to handle multi-thread scenarios more efficiently.
• SSH: Added certificate-based constructor to SshPublicKey class.
• SSH: Added support for certificate-based server authentication (using 'x509v3-sign-rsa algorithm').
• SSH: Fixed misleading error message when user interactive authentication attempt is rejected.
• SSH: Added support for one additional 'keyboard-interactive' authentication prompt ('Password for [user@server]:').
• SSH: Added Settings.PostponeChannelClose option to enable workaround for servers that send channel data or exit code after the channel has been closed.
• SSH: Added EnableSignaturePadding option that forces signature padding (workaround for SSH servers that got signature padding wrong).
• SSH: Added logging of debug messages received from SSH server.
• TLS/SSL: TLS 1.2 made compatible with Microsoft's implementation.
• TLS/SSL: Fixed client certificate authentication in TLS 1.2.
• TLS/SSL: Added Settings.​SslMinimumDiffieHellmanKeySize value (set to 1024 by default to mitigate Logjam attacks).
• TLS/SSL: Added reliable detection of SHA-2 certificate support.
• Cryptography: Enhanced cryptographic provider initialization error message.
• Cryptography: Added workaround for PuTTY keys with bad data at the end.
• Common: Fixed multi-file operations to never modify input FileSet's BasePath.
• Common: ThreadPool is now used to handle background operations instead of a custom implementation.
• Common: Enhanced multithread operation support in log writers.

2015 R4.1 #

(build 5715 from 2015-08-24)

Fixed Xamarin mobile platform detection

Fixed platform detection code on Xamarin.iOS and Xamarin.Android.

Detailed list of changes:

• All: Fixed platform detection on Xamarin.Android and Xamarin.iOS.
• All: Version and platform added to assembly description.

2015 R4 #

(build 5700 from 2015-08-09)

Support for Windows 10, .NET Framework 4.6 and Visual Studio 2015

All Rebex libraries now ship with full support for Windows 10, .NET Framework 4.6 and Microsoft Visual Studio 2015. Older Visual Studio versions (2005 and higher) and .NET Framework versions (2.0 and higher) are still supported as well.

Faster TLS/SSL and SSH negotiation on Xamarin.Android

Our SSH and TLS/SSL libraries now use Java-based Diffie-Hellman on Xamarin.Android, which substantially speeds up SSH and TLS/SSL negotiation when Diffie-Hellman algorithm is used.

Detailed list of changes:

• All: Enhanced platform detection code.
• File Server: Added support for UNC paths.
• File Server: Fixed issues with HMAC-SHA1 and HMAC-MD5 in FIPS-only mode.
• File Server: Added support for message authentication algorithms based on SHA-2 on .NET Compact Framework (when supported natively).
• File Server: Fixed handling of "empty" read requests (used to send back EOF instead of an empty block).
• File Server: Enhanced subsystem shutdown process to prevent exception messages in the log.
• File Server: LogLevel for SFTP filesystem errors lowered from Debug to Verbose.
• SSH: Added Settings.TryPasswordFirst and Settings.​WaitForServerWelcomeMessage workarounds to Scp and Ssh.
• SSH: Added support for message authentication algorithms based on SHA-2 on .NET Compact Framework (when supported natively).
• SSH: Fixed NullReferenceException thrown by some SshSession properties (such as IsConnected) when not connected.
• SSH: SHA-2 is now the preferred message authentication algorithm.
• SSH: Added logging of SSH packet header data on decoding error.
• SSH: Added support for larger SSH packets.
• TLS/SSL: Unified status handling in ValidatingCertificate events and ICertificateVerifier interface.
• TLS/SSL: Enhanced TLS/SSL version mismatch handling.
• Cryptography: Fixed final empty block handling in Twofish/Blowfish/ArcTwo TransformFinalBlock with PKCS #7 padding.
• Cryptography: SSH and TLS/SSL now use Java-based Diffie-Hellman objects on Xamarin.Android platform to speed up negotiation.
• Common: Fixed end-of-line sequences in LogWriterBase, optimized FileLogWriter.
• Common: Added workaround for broken ASN.1 time values with the second part of "60".

2015 R3.1 #

(build 5584 from 2015-04-15)

File Server bugfixes

Two bugs have been fixed in Rebex File Server. One bug caused errors in WinSCP while uploading files over SFTP, another bug made it impossible to create files and directories whose names contained whitespaces when uploading over SCP.

Detailed list of changes:

• File Server: Fixed SFTP file creation that was not compatible with WinSCP.
• File Server: Fixed SSH packet names in verbose log.
• File Server: Fixed handling of filenames with whitespaces in SCP.
• File Server: Disabled legacy "arcfour" SSH cipher by default.
• SSH: Disabled legacy "arcfour" SSH cipher by default.
• SSH: Fixed a bug that caused an algorithm list set by Settings.​SshParameters.​SetEncryptionAlgorithms to be ignored in FIPS-compliant mode.

2015 R3 #

(build 5577 from 2015-04-08)

New library - Rebex File Server

Rebex File Server is an SFTP, SCP and SSH server library. It provides secure remote file system access over an SSH channel using the SFTP or SCP protocols and makes it simple create an SFTP server that can be used by Rebex SFTP or any third-party SFTP, SCP or SSH client. Supports .NET Framework, .NET Compact Framework, Mono, Xamarin.iOS and Xamarin.Android. Available as a standalone package or as a part of Rebex File Transfer Pack, Rebex SSH Pack or Rebex Total Pack.

Detailed list of changes:

• All: Fixed Version property of Ftp, Imap, Pop3, Scp, Sftp, Smtp and Ssh classes to return a proper version number. Changed Ftp.Version to a static propery to match the other objects.
• File Server: Initial release.
• SSH: Enhanced some authentication error messages.
• TLS/SSL: Disabled ciphers based on RC4 to prevend Bar Mitzvah attack on TLS/SSL.
• Cryptography: Enhanced weak signature algorithm detection during certificate validation on Xamarin.iOS.
• Common: Connect methods no longer require FileIOPermission (used to determine the assembly version for a log).