Current Situation
Oracle BI Publisher currently supports hmac-sha2-256 and
hmac-sha2-512 for SFTP delivery, but does not support their
ETM (Encrypt-then-MAC) variants:
- hmac-sha2-256-etm@openssh.com
- hmac-sha2-512-etm@openssh.com
Business Impact
This is blocking SFTP connectivity between Oracle BI Publisher
and modern SFTP servers that enforce ETM-only MAC algorithms
for compliance (SOC 2, FIPS). As ETM enforcement becomes
increasingly common, this will affect more Oracle customers.
Proposed Solution
Add support for ETM MAC variants in BI Publisher's SFTP
delivery, either by including them in the default supported
algorithm list, or by providing a configuration option
(e.g. xdo.cfg) to explicitly specify preferred MAC algorithms.
ETM has been standard in OpenSSH since 2013 — this enhancement
would bring BI Publisher in line with modern SSH security
standards.
