This is a quick guide about the basics of SFTP: what it is, how it works and when to use it. However, before we dive into those details, let’s first discuss the basics of file transfer protocols.
Basics of file transfer protocol
A file transfer protocol refers to the method that two or more computers use to communicate with each other.
There are two types of protocols: secure and insecure.
Secure protocols encrypt the channel that files are transferred over so that if someone intercepts the files, they can’t read them. Insecure protocols don’t encrypt the channel, which means anyone can intercept and read the files. This is especially a problem when files contain confidential information like social security numbers, credit card numbers, etc.
SFTP, HTTPS and FTPS are secure protocols while HTTP and FTP are insecure.
What is SFTP?
SFTP stands for SSH File Transfer Protocol or Secure File Transfer Protocol. SFTP transfers files using Secure Shell (SSH), which is an encrypted protocol. I’ll dive into what SSH is below.
There are two important things to know about SFTP:
- Before any files are transferred, the connection is encrypted.
- There’s no way to send files over SFTP unencrypted.
How does SFTP work?
Before an SFTP file transfer can occur, the client and server verify the connection via a three-way handshake (see the following TCP section for more details). Then, they authenticate each other (see the SSH section below).
Finally, the file is transferred over the encrypted channel in packets. Each packet has some of the data being transferred. At the receiving end, the packets are put back together into the original file.
Does SFTP use TCP or UDP?
Let’s start with the basics. SFTP uses transmission control protocol (TCP), not user datagram protocol (UDP). Here’s why that matters:
Before computers send or receive data, they can either verify that the other computer is ready to receive files or not.
TCP is a connection-oriented protocol, which means that both computers verify a connection before files are sent. TCP does this with a three-way handshake.
There are two computers involved:
- The sending computer will send the data.
- The receiving computer will receive the data.
The three-way handshake consists of three steps:
- Sending computer sends a message called a SYN.
- Receiving computer sends back an acknowledgement message called a SYN ACK.
- Sending computer sends an ACK RECEIVED MESSAGE to the receiving computer.
After the handshake is complete, data is delivered. If data doesn’t arrive, TCP will make sure that it is re-sent.
Unlike TCP, UDP is a connectionless protocol, which means that neither computer acknowledges the other before sending or receiving files. If UDP is used, the receiving computer may get a file out of order or in pieces.
So SFTP uses SSH. How does SSH work?
There are three steps for an SSH connection to be established:
- The client verifies the server.
- The client and server generate a session key together.
- The server authenticates the client.
Step 1: The Client Verifies the Server
The SSH server at port 22 is always waiting for client requests. When a client initiates a connection, it starts by verifying the server’s identity.
There are two possible scenarios:
- The client is accessing the server for the first time, so the user has to manually verify the public key of the server.
- The client isn’t accessing the server for the first time, so the server’s identity was recorded before and can be verified without user involvement.
Step 2: Generating a Session Key
The client and server agree on a session key that will encrypt and decrypt the data. This key is randomly generated and known as “symmetric” because it’s used for encryption and decryption.
Step 3: The Server Authenticates the Client
The server authenticates the client using an SSH key pair. A key pair is made of a public key, which both parties know, and a private key, which should only be known to the right client.
To verify that the client has the right private key, the server uses a random number it picks and the shared session key. It calculates the MD5 hash of this value. (MD5 is a hashing algorithm that produces a unique, fixed-length string. Think of it as a code that always delivers the same result for the same string.)
If the client’s MD5 hash matches the server’s, it proves that the client has the private key. SSH authentication is complete.
Go beyond the basics of SFTP
If you want to learn more about SFTP, check out our comprehensive guide about SFTP, including:
- What commands you can use with SFTP
- How SSH keys work
- How SFTP fits into the TCP/IP model
Beyond SFTP to MFT
SFTP servers may be sufficient if you need to occasionally transfer files, but as your file transfer volumes increase, it can become more difficult to onboard partners, scale and troubleshoot. SFTP servers also don’t have all the security features you need to be compliant with GDPR and other regulations.
Managed file transfer (MFT) solutions give your IT team one place to configure and manage automated file transfer workflows. Visit our secure file transfer to see more features that we support!
