This is a quick guide about the basics of Secure File Transfer Protocol (SFTP). The following topics are covered in this blog:
- Basics of File Transfer Protocols
- What Is SFTP?
- How Does SFTP Work?
- Does SFTP Use TCP or UDP?
- Since SFTP Uses SSH, How Does SSH Work?
- Go Beyond the Basics of SFTP
- Beyond SFTP to MFT
To get started, let’s first discuss the basics of file transfer protocols.
Basics of File Transfer Protocols
A file transfer protocol refers to the method that two or more computers use to communicate with each other during the transfer. The method is insecure or secure depending on the protocol type.
Insecure Protocols
HTTP and FTP are insecure protocols.
Insecure protocols don’t encrypt the channel that files are transferred over, which means anyone can intercept and read the files. This is especially problematic when files contain confidential information such as social security numbers, credit card numbers, etc.
Secure Protocols
SFTP, HTTPS and FTPS are secure protocols.
Secure protocols encrypt the channel that files are transferred over. Therefore, if someone actually manages to intercept the files, they aren’t able to read them. All file contents are protected by encryption. The encryption would need deciphered before the file contents could be read.
What Is SFTP?
SFTP stands for SSH File Transfer Protocol or Secure File Transfer Protocol. SFTP transfers files using Secure Shell (SSH), which is an encrypted protocol.
Before diving into details, there are two important things to know about SFTP:
- Before any files are transferred, the connection is encrypted.
- There’s no way to send files over SFTP unencrypted.
How Does SFTP Work?
Before an SFTP file transfer can occur, the client and server verify the connection via a three-way handshake (see the following TCP section for more details).
Then, they authenticate each other (see the SSH section below).
Finally, the file is transferred over the encrypted channel in packets. Each packet has some of the data being transferred. At the receiving end, the packets are put back together into the original file.
Does SFTP Use TCP or UDP?
Let’s start with the basics…
SFTP uses transmission control protocol (TCP), not user datagram protocol (UDP).
TCP is a connection-oriented protocol, which means that both computers verify a connection (i.e., verify whether or not the other computer is ready to receive data) before files are sent.
About UDP
Unlike TCP, UDP is a connectionless protocol, which means that neither computer acknowledges the other before sending or receiving files. If UDP is used, the receiving computer may get a file out of order or in pieces.
For clarification, let’s define the two computers:
- Sending computer will send the data.
- Receiving computer will receive the data.
TCP performs this verification with a three-way handshake, consisting of three steps:
- Sending computer sends a message called a SYN.
- Receiving computer sends back an acknowledgement message called a SYN ACK.
- Sending computer sends an ACK RECEIVED message to the receiving computer.
After the handshake is complete, data is delivered. If data doesn’t arrive, TCP will make sure that it is re-sent.
Since SFTP Uses SSH, How Does SSH Work?
An SSH connection is established in three steps:
The Client Verifies the Server »
The Client and Server Generate a Session Key Together »
The Server Authenticates the Client »
Step 1: The Client Verifies the Server
The SSH server at port 22 is always waiting for client requests. When a client initiates a connection, it starts by verifying the server’s identity.
There are two possible scenarios:
- The client is accessing the server for the first time, so the user has to manually verify the public key of the server.
- It’s not the first time the client is accessing the server, so the server’s identity was recorded before and can be verified without user involvement.
Step 2: The Client and Server Generate a Session Key Together
The client and server agree on a session key that will encrypt and decrypt the data. This key is randomly generated and known as “symmetric” because it’s used for encryption and decryption.
Step 3: The Server Authenticates the Client
The server authenticates the client using an SSH key pair. A key pair is made of a public key, which both parties know, and a private key, which should only be known to the right client.
To verify that the client has the right private key, the server uses a random number it picks and the shared session key. It calculates the MD5 hash of this value. (MD5 is a hashing algorithm that produces a unique, fixed-length string. Think of it as a code that always delivers the same result for the same string.)
If the client’s MD5 hash matches the server’s, it proves that the client has the private key. SSH authentication is complete.
Go Beyond the Basics of SFTP
If you want to learn more about SFTP, check out our comprehensive guide about SFTP, including
- SFTP facts
- How SFTP uses SSH and its keys
- How SFTP fits into the TCP/IP model
- The details of how SFTP works
- FAQs about SFTP
Beyond SFTP to MFT
SFTP servers may be sufficient if your organization only occasionally transfers files. However, as the file transfer volume increases, it can become more difficult to onboard partners, scale and troubleshoot. Additionally, SFTP servers don’t have all the security features needed to be compliant with GDPR and other regulations.
Managed file transfer (MFT) solutions give your IT team one place to configure and manage automated file transfer workflows. To learn more about Thru’s supported security features, visit our secure file transfer page »
