What is the SSH File Transfer Protocol?

Understanding File Transfer Protocol (FTP)

FTP or file transfer protocol, refers to a process of transferring files between two or more devices over the internet.

Protocols are of two types: secure and insecure.

Secure protocols encrypt the transmission channel over which the files are being transferred, so even if someone retrieves the file in transit, they won’t be able to read it. For example, SFTP, HTTPS, and FTPS. 

On the other hand, insecure protocols do not encrypt the communication channel. Which denotes that anyone can retrieve the files and read them. This is a critical issue, especially when the files being transferred contain sensitive data such as credit or debit card numbers, social security numbers, etc. For example, HTTP and FTP.

What Exactly is SFTP (SSH File Transfer Protocol)?

SFTP is an abbreviation for SSH file transfer protocol or secure file transfer protocol, which transfers one or more files over a secure shell (SSH) network. 

You need to know about 2 important factors regarding the SFTP for secure and seamless file transfer: 

• The transmission channel should be encrypted before transferring any file(s).
• You won’t be able to send files using SFTP without any encryption.

SFTP: How Does It Work?

Before transferring the file(s) over SFTP, the client and server validate their connection with a 3-way handshake and then validate each other’s identities. In the end, the file gets transferred over the secure transmission channel in the form of packets. Each packet contains data to be transferred. The packets are reassembled once they reach the receiving end.

– What Does SFTP Use: TCP or UDP? 

Starting with the basics, the SFTP protocol makes use of TCP (Transmission Control Protocol) and not the UDP (User Datagram Protocol). It is because:

Before transferring the data, the sender and receiver devices need to validate whether the destination device is prepared to receive the files. A transmission control protocol (TCP) is a connection-based protocol, using which both devices validate a connection between them before sending the data with a three-way handshake.

The steps in a three-way handshake include:

• A sender device sends a synchronize message known as a SYN.
• A receiver device sends back a synchronize-acknowledge message known as SYN-ACK.
• A sender computer sends an acknowledgment (ACK) received message to the receiver. 

After the handshake phase, data is transferred. If the file doesn’t reach the receiving end, then the TCP protocol ensures that the file is resent.

Contrary to TCP, the UDP protocol is a connectionless protocol, which means none of the two computers acknowledge each other before transferring the files. Also, when using UDP, the destination device might receive a disorganized file or fragments. Thus, 

SFTP Leverages SSH and This Is How It Works: 

The three steps for establishing an SSH connection include: 

• The client ensures the server’s authenticity.
• A session key is jointly created by the client and server.
• The client’s identity is confirmed by the server. 

Step-1: The client ensures the server’s authenticity

An SSH server constantly awaits client requests at SFTP port number 22. When a client begins a connection process, it starts by checking the server’s authenticity. There are two potential outcomes: 

• It could be the first time the client is accessing the server; therefore, the user needs to manually authenticate the server’s public key.
• It could be that the client isn’t accessing the server for the first time; therefore, the server’s identity was already recorded and can be validated without the user’s intervention.

Step-2: A session key is jointly generated by the client and server

A session key is jointly agreed upon by the client and server, which helps in encrypting and decrypting the data. This key is known as the “Symmetric” key, as it is crucial for data encryption and decryption and it is generated randomly. 

Step-3: The client’s authenticity is confirmed by the server

With the help of an SSH key pair, the server verifies the client. This key pair consists of a public key, which is exclusively known to the authorized client. To validate that the client holds the accurate private key, the server utilizes any number next to the shared session key.

After this, it derives the MD5 hash based on this value. Here, MD5 is a hashing technique that generates a distinct and constant-length string. You can imagine it as a consistent code that always produces a similar output for a similar value. When the client’s MD5 hash aligns with the server’s, it validates the client’s private key, completing SSH authentication.

Related: Secure File Transfer Protocol (SFTP) vs SSH: Unheard Differences [2024]