SFTP Basics

December 7, 2022 / File Security / how does sftp work, secure file transfer
Share:

A file transfer requires 2 or more computers to communicate with each other. The method they use to communicate is called a file transfer protocol.

There are two types of protocols: secure and insecure.

Secure protocols encrypt the channel that files are transferred over so that if someone intercepts the files, they can’t read them. Insecure protocols don’t encrypt the channel, which means anyone can intercept and read the files. This is especially a problem when files contain confidential information like social security numbers, credit card numbers, etc.

SFTP, HTTPS and FTPS are secure protocols while HTTP and FTP are insecure.

SFTP vs FTP secure file transfer encryption basics

This is a quick guide about the basics of SFTP: what it is, how it works and when to use it.

 

What is SFTP?

SFTP stands for SSH File Transfer Protocol or Secure File Transfer Protocol. SFTP transfers files using SSH (Secure Shell), which is an encrypted protocol. I’ll dive into what SSH is below.

There are two important things to know about SFTP encryption:

  1. Before any files are transferred, the connection is encrypted.
  2. There’s no way to send files over SFTP unencrypted.
 

Does SFTP use TCP or UDP?

Before I describe how SFTP works, let’s start with the basics. SFTP uses TCP (transmission control protocol), not UDP (user datagram protocol). Here’s why that matters:

Before computers send or receive data, they can either verify that the other computer is ready to receive files or not.

TCP is a connection-oriented protocol, which means that both computers verify a connection before files are sent. TCP does this with a three-way handshake.

There are two computers involved:

  1. The sending computer will send the data.
  2. The receiving computer will receive the data.

There are three steps in a three-way handshake:

  1. Sending computer sends a message called a SYN.
  2. Receiving computer sends back an acknowledgement message called a SYN ACK.
  3. Sending computer sends an ACK RECEIVED MESSAGE to the receiving computer.

After the handshake is complete, data is delivered. If data doesn’t arrive, TCP will make sure that it is re-sent.

tcp secure file transfer between two computers

Unlike TCP, UDP is a connectionless protocol, which means that neither computer acknowledges the other before sending or receiving files. If UDP is used, the receiving computer may get a file out of order or in pieces.

 

So SFTP uses SSH. How does SSH work?

There are three steps for an SSH connection to be established:

  1. The client verifies the server.
  2. The client and server generate a session key together.
  3. The server authenticates the client.

sftp uses ssh to establish a connection

Step 1: The Client Verifies the Server

The SSH server at port 22 is always waiting for client requests. When a client initiates a connection, it starts by verifying the server’s identity.

There are two possible scenarios:

  1. The client is accessing the server for the first time, so the user has to manually verify the public key of the server.
  2. The client isn’t accessing the server for the first time, so the server’s identity was recorded before and can be verified without user involvement.

Step 2: Generating a Session Key

The client and server agree on a session key that will encrypt and decrypt the data. This key is randomly generated and known as “symmetric” because it’s used for encryption and decryption.

Step 3: The Server Authenticates the Client

The server authenticates the client using an SSH key pair. A key pair is made of a public key, which both parties know, and a private key, which should only be known to the right client.

To verify that the client has the right private key, the server uses a random number it picks and the shared session key. It calculates the MD5 hash of this value. (MD5 is a hashing algorithm that produces a unique, fixed-length string. Think of it as a code that always delivers the same result for the same string.)

If the client’s MD5 hash matches the server’s, it proves that the client has the private key. SSH authentication is complete.

 

How does SFTP work?

Before an SFTP file transfer can occur, the client and server verify the connection via a three-way handshake (see the TCP section above). Then, they authenticate each other (see the SSH section above).

Finally, the file is transferred over the encrypted channel in packets. Each packet has some of the data being transferred. At the receiving end, the packets are put back together into the original file.

how does sftp work basics

 

Go beyond the basics of SFTP

If you want to learn more about SFTP, check out our comprehensive guide about SFTP to learn more, including:

  • What commands you can use with SFTP
  • How SSH keys work
  • How SFTP fits into the TCP/IP model
 

Beyond SFTP to MFT

SFTP servers are sufficient if you need to occasionally transfer files, but as your file transfer volumes increase, it can become more difficult to onboard partners, scale and troubleshoot. SFTP servers also don’t have all the security features you need to be compliant with GDPR and other regulations.

Managed file transfer (MFT) solutions give your IT team one place to configure and manage automated file transfer workflows. Visit our secure file transfer to see more features that we support!

 

https://www.ssh.com/academy/ssh/
https://sectigostore.com/blog/tcp-vs-udp-whats-the-difference/
https://medium.com/@Magical_Mudit/understanding-ssh-workflow-66a0e8d4bf65

 
Share:

Have questions about managed file transfer?

Get answers, not a sales pitch. Our experts have analyzed, discussed and solved difficult file transfer challenges since 2002. We are here to help you.

Scroll to Top