front | blog | talks | videos | docs | photos | podcasts | contact | about me
Related: FTP vs HTTP, curl vs wget and bittorrent vs HTTP

Encrypted Transfer Protocols Compared

curl supports a wide variety of protocols. Subsequently people who use curl get to chose which protocol to use based on other criterias. So how exactly do the various encrypted transfer protocols compare?

This document describes and compares SCP, SFTP, HTTPS and FTPS and it considers both upload and download, as none of the protocols differ very much for transports done in either direction.

SSH - SCP and SFTP

SSH (RFC4251) is not drastically different than SSL on the lowest transport layer, where the actual encryption of the data is made. Block by block is encrypted with a key using a negotiated algorithm.

SSH uses no certificates and there's no CAs or chain of trust based on certs. In SSH you trust the hosts for which you have a known public key. And you know that key because you connected to the host before, or you got it sent to you.

The SSH based protocols do suffer when used on high latency high bandwidth networks compared to SSL based ones, due to the packet-back-and-forth concepts.

There's a surprising lack of libraries for SSH. libssh2 and libssh being exceptions.

SCP

SFTP

SSL - HTTPS and FTPS

SSL is basically about encrypting the data using a negotiated algorithm. It features a trust concept with certificates, where clients decide to trust servers to be who they claim to be on the basis that their certificates are signed by Certificate Authority that the client trusts. The use of cacerts is widely misunderstood or even misused.

The differences between FTPS and HTTPS are pretty much the exact same differences as between FTP and HTTP. The SSL part just makes the data streams being encrypted by the sending end.

There's a wide range of mature and good libs (OpenSSL, GnuTLS, NSS, (C)yaSSL, MatrixSSL, ...) that help apps do SSL/TLS easily.

FTPS

HTTPS
Encrypted p2p networks

A related area is encrypted p2p networking protocols. I've yet to research and learn about what's available and how they work before they can be added to this comparison in any good fashion. Please tell me if you have insight knowledge. Links: Anomos.

Thanks

Feedback and improvements by: Tomas Salfischberger, Joe Born

Updated: September 3, 2021 15:13 (Central European, Stockholm Sweden)