File transfer sftp secure?

Question

Suppose I have a text file with confidential information. I want to transfer from American facility to the france facility via sftp set up in a website.

Is the file transfer secure?

Answer 1

From the wikipedia article: SSH File Transfer Protocol

The protocol itself does not provide authentication and security; it expects the underlying protocol to secure this. SFTP is most often used as subsystem of SSH protocol version 2 implementations, having been designed by the same working group. However, it is possible to run it over SSH-1 (and some implementations support this) or other data streams. Running SFTP server over SSH-1 is not platform independent as SSH-1 does not support the concept of subsystems. An SFTP client willing to connect to an SSH-1 server needs to know the path to the SFTP server binary on the server side.

so it really depends on the way you set this up.

Read the whole article if you are interested.

Answer 2

As Davide Piras pointed out SFTP or more precisely the underlying SSH protocol can be quite secure.

But if I understood you correctly you want to use some kind of web-based SFTP client. That means that you also have to secure the connection between your client and the web-site you're using to transfer the file.

Rather than trying to get transport security right (which you should do none the less) you should encrypt the data itself (e. g. with PGP or GnuPG), transfer that encrypted file and finally decrypt it on the target system.

Answer 3

While SSL and TLS differ in ways that make them inoperable with each other, they are generally considered equal in terms of security. The main difference is that, while SSL connections begin with security and proceed directly to secured communications, TLS connections first begin with an insecure “hello” to the server and only switch to secured communications after the handshake between the client and the server is successful. If the TLS handshake fails for any reason, the connection is never created.

If you use Windows (like I do) , this being the case, instead of a FTPS server (such as FileZilla), you probably just want a SFTP capable, non-TLS, server (which is based on SSH) such as NULL FTP Server or what I use: WinSSHD with Tunnelier client.

Answer 4

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.IO;
using System.Security.Cryptography;

namespace Encryption
{
    class Program
    {
        static void Main(string[] args)
        {
            EncryptFile(@"C:\a.txt", @"C:\b.txt","password");
            DecryptFile(@"C:\b.txt", @"C:\decrypted.txt",@"password");
        }
        public static void EncryptFile(string inputFile, string outputFile,string password)
        {

            try
            {

                UnicodeEncoding UE = new UnicodeEncoding();
                byte[] key = UE.GetBytes(password);

                string cryptFile = outputFile;
                FileStream fsCrypt = new FileStream(cryptFile, FileMode.Create);

                RijndaelManaged RMCrypto = new RijndaelManaged();

                CryptoStream cs = new CryptoStream(fsCrypt,
                    RMCrypto.CreateEncryptor(key, key),
                    CryptoStreamMode.Write);

                FileStream fsIn = new FileStream(inputFile, FileMode.Open);

                int data;
                while ((data = fsIn.ReadByte()) != -1)
                { 
                    cs.WriteByte((byte)data); 
                }


                fsIn.Close();
                cs.Close();
                fsCrypt.Close();
            }
            catch(Exception e)
            {
                Console.WriteLine(e);
            }
        }

        public static void DecryptFile(string inputFile, string outputFile,string password)
        {

            {


                UnicodeEncoding UE = new UnicodeEncoding();
                byte[] key = UE.GetBytes(password);

                FileStream fsCrypt = new FileStream(inputFile, FileMode.Open);

                RijndaelManaged RMCrypto = new RijndaelManaged();

                CryptoStream cs = new CryptoStream(fsCrypt,
                    RMCrypto.CreateDecryptor(key, key),
                    CryptoStreamMode.Read);

                FileStream fsOut = new FileStream(outputFile, FileMode.Create);

                int data;
                while ((data = cs.ReadByte()) != -1)
                    fsOut.WriteByte((byte)data);

                fsOut.Close();
                cs.Close();
                fsCrypt.Close();

            }
        }

    }
}