technologybriefs
9:42in productionCh. 1 · Not FTP over SSH/ 9:42 · ceiling 15 min
Security

SSH File Transfer Protocol

Tatu Ylonen

SFTP doesn’t secure your files—it assumes they’re already secure.

SFTP is a file protocol built for SSH-2. It assumes security is already solved. It delivers precise, stateful filesystem control. It never became an RFC. It remains widely deployed—not because it succeeded, but because alternatives failed.

SecurityCryptographyCybersecurityThe internetCryptography across the network →
Chapters & takeaways4
  1. 0:58
    Not FTP over SSH

    SFTP was built to be the standard file transfer protocol for SSH-2—not a wrapper, not a tunnel, but a native extension.

  2. 2:52
    No security of its own

    It expects authentication and encryption to be handled upstream—SFTP itself has no login flow, no key exchange, no cipher negotiation.

  3. 4:19
    Filesystem, not just files

    It provides full remote filesystem semantics—access, transfer, and management—not just upload and download.

  4. 5:27
    Drafted once, never finalised

    Its July 2006 IETF draft defines it as portable across secure transports—including TLS—but it remains tied to SSH-2 in practice.

Worth your time?

Yes. Study the whole thing.

3.5/ 5
What works
  • stateful file operations
  • permission-aware transfers
  • SSH-2 integration
What does not
  • provide authentication
  • standardise beyond draft status
  • replace FTPS or FTP-over-SSH
Study it if
  • sysadmins managing SSH-2 infrastructure
  • developers building cross-platform file tools
  • auditors assessing protocol-layer responsibilities
Skip it if
  • teams deploying TLS-first services
  • legacy FTP migration projects
  • zero-trust network architects
The written brief1 min read

What it is and the problem it solves

SFTP is a network protocol designed by the IETF SECSH working group to provide secure file access, transfer, and management over any reliable data stream. It solves the problem of insecure, stateless, and unencrypted file transfers by building on SSH-2’s authenticated channel.

How it works

It runs over a pre-authenticated secure channel like SSH-2. It delegates authentication, encryption, and integrity to that channel. It is not FTP tunneled through SSH but a new protocol built from scratch for file access, transfer, and management.

What works

It works as a secure, bidirectional, session-based file protocol over SSH-2. It supports directory listing, file upload/download, permissions, symbolic links, and atomic renames. It can be adapted to TLS or VPN management contexts, per its design scope.

What does not

It does not provide authentication or security. It does not replace FTPS or FTP-over-SSH. It does not standardise beyond the IETF draft stage. It does not define how to bootstrap the underlying secure channel.

What it changes

It replaces ad-hoc FTP-over-SSH wrappers with a single, coherent, extensible protocol for remote file system interaction. It shifts responsibility for security from the file transfer layer to the transport layer.

Is it worth your time

Yes—if you need secure, stateful, platform-agnostic file operations over an existing SSH-2 infrastructure. No—if you require built-in authentication, TLS-native deployment, or compatibility with legacy FTP tooling.

Same field · Security4 of 8
8:32
Bitcoin2009Bitcoin is the first decentralized cryptocurrency. It solves double-spending without a trusted intermediary. Its mechanism relies on proof-of-work mining, public blockchain replication, and cryptographic key control. It delivers decentralisation, Sybil resistance, and Byzantine fault tolerance—but only if users protect private keys. It does not solve scalability, energy use, or usability. It changes what digital money can be—but not what it must be.
10:41
Diffie–Hellman key exchangeDiffie–Hellman key exchange is a foundational cryptographic protocol that enables two parties to derive a shared secret over an insecure channel using modular exponentiation in a finite group. Published in 1976, it introduced the first publicly known private–public key concept and remains embedded in internet infrastructure. But it provides no authentication—making it vulnerable to man-in-the-middle attacks unless combined with digital signatures or certificates.
10:45
HTTPS1994HTTPS is the foundational encryption layer for web traffic. It delivers real security in transit — but only when deployed with care. Its value lies not in novelty, but in necessity.
9:54
NXP Semiconductors1953NXP Semiconductors co-invented NFC with Sony and Inside Secure. Its chipsets enabled secure mobile payments and data exchange via short-range electromagnetic coupling. The technology works — but only within strict physical and cryptographic constraints. It changed how identity and value move at point-of-sale — yet offers no inherent security beyond what the host system implements. Worth your time if you build or integrate secure embedded systems.
Up next in Technology

Standard-gauge railway

George Stephenson · 10:59

Stephenson didn’t discover a universal truth — he imposed a compromise, then legislated it.

Play nextBack to Security
10:59