• About SSH
• Security
• Screenshots
• Customers
• Specifications

• Install SSH Server
• Change port number
• Install SSH Client
• Connect first time
• Windows accounts
• Virtual accounts
• Configure SFTP / SCP
• Configure Git access
• Open to internet access
• Public key: Bitvise
• Harden SSH Server

• Version history
• Pricing
• License
• Download
  • WRC
• Notifications
• Help
  • Users' Guide
    • Installing
    • Upgrading
    • Starting & logs
    • Connecting
    • Config for SFTP
    • FTPS compatibility
    • Securing
    • Host keys
    • Backup
    • Opening
    • Groups, accounts
    • Architecture
    • Windows domains
    • AD permissions
    • Network shares
    • Logon type
    • Public keys
    • Tunneling
    • Sync & clusters
    • Environment
    • Tasks, notifications
    • Scripted config
    • Log filtering
    • Log parsing
    • Advanced
    • Utilities
  • Printable docs
  • Usage FAQ
  • Public keys in SSH
  • Upgrading DSA
  • Internet explained

• Version history
• License
• Download
• Notifications
• Portable
• The 'log' utility
• Help
  • Internet explained
  • Public keys in SSH
  • Upgrading DSA
  • Port forwarding guide
  • SSH web browsing
  • Git with sexec
  • Authentication agents
  • X11 forwarding
  • Tunnel Remote Desktop
  • FTP bridge
  • Tunnel VNC
  • SSH client as service
  • Unattended use

• Version history
• Notifications
• Documentation

• SSH Server
• SSH Client
• WRC
• Verify installers
• Uninstalling

• Support and upgrades
• Large scale
• Reseller list
• Reseller policy

• About us
• Work at Bitvise
• Contact

FlowSsh: SSH client library for C, C++ and .NET

The same SSH library as we use in our SSH server for Windows is available for licensing for SSH client applications.

Features:

• Separate easy to use interfaces for C, C++, and .NET.

• Well-documented.

• Comes with several sample applications in C, C++, C#, and Visual Basic.

• Supports public key authentication.

• Supports SFTP and tunneling / port forwarding.

• Supports general channel types, including exec requests and terminal sessions. (Terminal emulation not included.)

• Supports ZLIB compression. (But does not use the widely used zlib library.)

• Supports connecting through a proxy.

• Provides state-of-the-art encryption and security suitable as part of a standards-compliant solution meeting the requirements of PCI, HIPAA, or FIPS 140 validation. Supports post-quantum key exchange (not in FIPS mode).

• Compatible with 64-bit and 32-bit Windows applications. (Non-Windows platforms not supported.)

• Code base separate and independent of other SSH implementations. Does not use OpenSSH, OpenSSL, or libssh.

• Does not contain parts subject to GPL or similar restrictive licenses.

Included in Bitvise SSH Client

FlowSshNet is included with our SSH Client, and can be used under the Bitvise SSH Client license on computers where the Client is installed. PowerShell scripts are included under the SSH Client installation directory, demonstrating how to use FlowSshNet with PowerShell. Look for the following samples in your installation:

• FlowSshNetSamples\FlowSshNet_Exec.ps1

• FlowSshNetSamples\FlowSshNet_Sftp.ps1

Download the Latest Version  

For use independent of Bitvise SSH Client, FlowSsh 9.67 is available for download:

Build instructions and license terms are included in the archive.

Use of FlowSsh for evaluation and testing is free of charge. To include FlowSsh in your production application, contact us.

When used without a license, FlowSsh will display an evaluation dialog unless Bitvise SSH Client is also installed. To avoid the evaluation dialog during testing, install Bitvise SSH Client.

Documentation

Complete FlowSsh documentation can be found here.

Pricing

FlowSsh is available in the following license types:

It can be used free of charge under the Bitvise SSH Client license on computers where Bitvise SSH Client is installed. All paid licenses are intended for use in applications independently of Bitvise SSH Client.

A per-developer license costs USD 599.95 per developer. It is valid for any number of programs and applications, but requires a fee for each developer involved in writing programs that use FlowSsh.

A per-application license costs USD 599.95 per application. It permits use by an unlimited number of developers, but is valid only for a single, specific application.

A full source code license costs USD 5,000. It permits modification of source code, and use in multiple products. It allows use of the inner FlowSsh library in server applications, which the outer FlowSshC, C++, and .NET wrappers do not. However, it does not permit distribution of FlowSsh source code, or use in general-purpose SSH products, competing with Bitvise's.

There are no royalty fees based on use of the resulting applications. Use in commercial programs is permitted and encouraged.

Each license type comes with 12 months of free access to new versions of FlowSsh. Subsequently, upgrade access extension is optional, and is available at 20% of the license price per year. Like with our other licenses, upgrade access years cannot be skipped, but there are also no penalties for retroactive upgrade access extension.

To purchase a license, please contact us.

Architectural Limitations

In our current design, FlowSsh is incompatible with applications that use .NET Application Domains. The FlowSsh implementation makes heavy use of fibers, which .NET Application Domains do not support. This means FlowSsh is not a suitable choice for use in ASP.NET (within an IIS process).

Support

Bug reports, suggestions, and specific questions to which direct responses are possible, are handled free of charge. Please contact us if you would like to suggest a feature or report an issue.

Bitvise does not provide real-time support, or assistance with step-by-step instructions.

Encryption and security features

SSH and SFTP:

• Key exchange algorithms:

  • Hybrid, post-quantum ML-KEM 1024 + ECDH/nistp384
  • Hybrid, post-quantum ML-KEM 768 + Curve25519
  • Curve25519
  • ECDH over elliptic curves secp256k1, nistp256, nistp384, nistp521 using SHA-512, SHA-384, or SHA-256
  • Diffie Hellman with group exchange using SHA-256
  • Diffie Hellman with fixed 4096, 3072, or 2048-bit group parameters using SHA-512 or SHA-256
  • Diffie Hellman with 1024-bit group parameters or using SHA-1 (legacy)
  • GSSAPI key exchange using Diffie Hellman and Kerberos authentication

• Signature algorithms:

  • Ed25519
  • ECDSA over elliptic curves secp256k1, nistp256, nistp384, nistp521 using SHA-512, SHA-384, or SHA-256
  • RSA using 4096, 3072, or 2048-bit key sizes with SHA-512 or SHA-256
  • RSA using 1024-bit keys or with SHA-1 (legacy)
  • DSA using SHA-1 (legacy)

• Encryption algorithms:

  • ChaCha20 with 256-bit keys with Poly1305
  • AES with 256, 128-bit keys in GCM mode
  • AES with 256, 192, 128-bit keys in CTR mode
  • AES with 256, 192, 128-bit keys in CBC mode (legacy)
  • 3DES in CTR or CBC mode (legacy)

• Data integrity protection:

  • ChaCha20 with 256-bit keys with Poly1305
  • AES with 256, 128-bit keys in GCM mode
  • HMAC using SHA-256 or SHA-512, in encrypt-then-MAC mode
  • HMAC using SHA-256 or SHA-512 (classic)
  • HMAC using SHA-1 (legacy)

• Server authentication:

  • Client verifies server identity using server host key fingerprint or public key
  • Automatic synchronization of new host keys to client supported

• Client authentication:

  • Password authentication
  • Password change during password authentication
  • Public key authentication

FIPS 140 validation

When FIPS cryptography is enabled in Windows, Bitvise software uses Windows built-in cryptography, validated by NIST under certificates specific for the Windows version in use. When FIPS mode is not enabled, additional non-Windows algorithms are supported.

Cryptographic implementations and availability

Current Bitvise software versions (9.67 and newer) use the following cryptographic implementations for different algorithms, on different versions of Windows:

Notes:

• Crypto++: A fork of Crypto++ 5.6 with Bitvise's updates.
• DJB: Reference implementation by Daniel J. Bernstein.
• GG: AVX2 implementation by Goll & Gueron; used if the CPU supports AVX2.
• If FIPS 140 cryptography is enabled in Windows Vista and newer, only Windows CNG algorithms are supported.

Documentation

Click here for FlowSsh documentation.

Notifications

Subscribe to be notified of new versions as they are released. It is easy to unsubscribe, and we will not share addresses with third parties.