Cloud Migration Assistants are transitioning to improved hashing standards

[#1]

Hello Atlassian Community,

In order to enhance the security and reliability of your data migrations, we are implementing updates to the Jira Cloud Migration Assistant (JCMA) and Confluence Cloud Migration Assistant (CCMA).

What's changing?

Starting with our July 2024 releases, we will shift from SHA1 and MD5 hashing algorithms to the more secure SHA256. This adjustment aligns with our goal of achieving FedRAMP Moderate authorization and complying with international security standards.

To ensure a seamless transition and upgrade process, we will still support the following Cloud Migration Assistants (CMAs) using SHA1 and MD5:

• JCMA: Versions 1.11.12 and below
• CCMA: Versions 3.10.0 and below

Support for these versions will be available until February 1, 2025. From this date onward, all migrations must be carried out using our latest CMA versions, which offer enhanced security and reliability.

Key dates:

• Now to January 31, 2025:

  • Upgrade your CMAs to the latest CMA versions supported by SHA256:

    • JCMA 1.11.13 and above

    •  CCMA 3.10.1 and above

• February 1, 2025 and onward:

  • We’ll stop supporting the following CMA versions:

    • JCMA 1.11.12 and below

    • CCMA 3.9.17 and below

Attempts to run your migration with these outdated versions will result in migration failure.

Benefits of the latest upgrade:

Enhanced security: Strengthens data protection during migration, safeguarding against potential vulnerabilities and breaches.

Compliance: Aligns with the latest global security standards, including FedRAMP, so your migration process remains compliant.

Improved performance: Enhances speed and performance to ensure a smoother and more reliable migration experience.

How to upgrade your Cloud Migration Assistants:

Starting a new migration?

• Install the latest version of JCMA.

• Install the latest version of CCMA.

Upgrading from an older version?

1. Check your current version:

   • Go to Administration > Manage apps.

   • Search for Jira Cloud Migration Assistant and Confluence Cloud Migration Assistant.

   • Verify the app version and update it to the latest version.

2. Pre-migration check prompt:

   • Upgrade to the latest version when prompted during pre-migration checks.

Completed a test migration with an older version?

• Retest with the latest version: It’s recommended to retest your migration with the updated version to ensure compatibility and enhanced security.

If you have any questions or need assistance in upgrading to the latest versions of JCMA or CCMA, contact us.

Thank you for joining us on this journey to a more secure cloud migration!

Warm regards,

The Atlassian Migration Team

[Taiwo Ojo - Alluvium]

Thanks for the update @Casey Chatman 

[Hans Polder]

@Casey Chatman ,

Thanks for the clear article! Did you really intend to write version ' JCMA 2.22.22 and below' as not supported? I feel like you intended to write 1.11.12 or 1.11.11 ;)

[Tim Eddelbüttel]

Is the terminology of encryption really appropriate when you talk about MD5, SHA1 and SHA256? 

It's not encryption, it's hashing of a string or binary with the intent is to prove its authenticity by validating a string or binary against the hash.

[Casey Chatman]

Hi @Tim Eddelbüttel

Thank you for your insightful comment! You're absolutely right, and we appreciate your attention to detail.

The terms "MD5", "SHA1", and "SHA256" indeed refer to hashing algorithms, rather than encryption standards. Hashing is used to ensure data integrity and authenticity, whereas encryption focuses on data confidentiality.

We value your input, as it helps us maintain accuracy and clarity in our communications. Thanks for helping us keep the Atlassian Community informed and knowledgeable!

Best,

Casey