* -------------------------------------------------
Introduction:
* -------------------------------------------------
One of the benefits of the internet is transferring file between computers to share information between people, but computers which run different operating systems need a common language between them to understand each other and this language is called protocols (Washburn et al., 1996). FTP (File Transfer Protocol) is a protocol to transfer files that described for the first time in the early seventies and standardized in 1982 (Matthews, 2005). SFTP (SSH File Transfer Protocol) is another file transfer protocol, but the first RFC describing SFTP was released in 2001 (Ylonen et al. 2001). Organizations have to provide file transfer services to their customers, and they should choose the secure file transfer protocol which will secure their costumers files. In this essay, a comparison between FTP and SFTP would be making from three aspects. Firstly, I will illustrate the differences between FTP and SFTP in starting communication methods, and how they maintain the connection and the ports used by them. Secondly, I will focus on security vulnerabilities of FTP and SFTP and their effects on users and files security. Finally, I will compare the speed of files transferring in FTP and SFTP for different files with different sizes. * -------------------------------------------------
Communication Approach: * -------------------------------------------------
System architecture identifies the system hardware and software requirements, and it has effects on system performance and throughput. FTP and SFTP are reliable data transfer services, which means they need to maintain the connection between the server and the client and guarantee transferred file integrity, because of this they were built on TCP (Transmission Control Protocol) (Postel et al., 1985; Matthews, 2005). FTP requires two types of connection: a control connection and a data connection (Postel et al., 1985; Brown et al., 1992; Matthews, 2005; Kurose et al., 2008; Washburn et al., 1996). The control connection is the first connection established between server and client, and the client is the only one having the ability to start it (Kurose et al., 2008; Matthews, 2005), and it is used for sending control information between them such as usernames and passwords (Postel et al., 1985; Matthews, 2005). The control connection remains open until the end of the session between the client and the server (Kurose et al., 2008; Matthews, 2005), and it uses port 21 to start and maintain the connection (Postel et al., 1985; Kurose et al., 2008; Matthews, 2005). Whereas, data connection uses port 20 (Kurose et al., 2008; Washburn et al., 1996), and it is established by the server or the client to transfer one file between the client and the server (Kurose et al., 2008; Washburn et al., 1996), and when the transferring of the file finished, the data connection would close (Postel et al., 1985; Kurose et al., 2008). After that, to send another file, the FTP server will establish a new data connection (Kurose et al., 2008). On the other hand, SFTP uses one connection between the client and the server to control connection, maintain connection and transfer data (Iyappan et al., 2009). As a result, SFTP needs only port 22 which is the SSH port (Krishna et al. 2011; Iyappan et al., 2009). Krishna et al. (2011) and Iyappan et al. (2009) argued that because SFTP uses SSH port (22) the network administrator does not need to allow different ports on his organization firewall. Another major difference between FTP and SFTP is that FTP uses Telnet (Postel et al., 1985; Brown et al., 1992), which is a popular application layer protocol used for remote log in (Kurose et al., 2008), while SFTP uses SSH (Secure Shell protocol) (Iyappan et al., 2009). The question is how these differences in architecture will affect the security and speed of FTP and SFTP. * -------------------------------------------------

* -------------------------------------------------
Security vulnerabilities: * -------------------------------------------------
Information security is an essential aspect, and it is considered as one of the main subjects in computer science. This paragraph will compare security vulnerabilities in file transfer protocols FTP and SFTP. In FTP protocol, if the FTP client seeks to start file transfer session, it sends his username to the FTP server which requests the client password (Kurose et al., 2008; Matthews, 2005). Then the client sends his password to the server which compares the username and password with its local database, and if the username and the password are correct, the server grants the client access to the server files (Postel et al., 1985; Washburn et al., 1996). The conversation between client and server transfers through the communication network as plain text without encryption (Liu et al., 2010; Iyappan et al., 2009; Matthews, 2005). In this case, there is a risk that the username and the password could be captured by packet sniffer (Matthews, 2005), who is a person use software to listen, log, and capture data packets when they pass through the network (Connolly, 2004), and then he can use them to access the FTP server and acquire confidential files or data. When FTP transfers files or data between server and client, it does not encrypt them too, and send them as plain text (Liu et al., 2010; Iyappan et al., 2009). Consequently, there is a risk that the files or the data may be captured by packet sniffer as well. In addition, many FTP servers allow public access where the clients will give the server "anonymous" as username and then set the password value to anything they want (Matthews, 2005; Washburn et al., 1996), which may cause fake access and untraceable activities. On the other hand, the conversations between the SFTP server and the SFTP client are encrypted by SSH using a secret key which mean even if a packet sniffer can capture packets of SFTP transmission, these packets are useless for him because they are encrypted and he does not have the ability to decrypt them without the secret key (Iyappan et al., 2009). Brown et al. (1992) argued that Vulnerabilities in FTP comes from the traditional assumption that computer networks are secure because computers operates and managed in secure rooms, but this thought conflict with the fact that data encryption standards (DES) approved in 1976 by the Secretary of Commerce as a Federal Information Processing Standard (FIPS) (Davis, 1978), whereas FTP defined in STD 9 after six years in 1982 (Matthews, 2005). To sum up SFTP is more secure than FTP because it encrypts all its transmissions, but we must consider how encryption and decryption will affect the time consumed to complete file or data transfer between the server and the client. * -------------------------------------------------
FTP and SFTP speed: * -------------------------------------------------
To secure any information, the price for the security should be paid, and the price for file transfer security is the time. The encryption of username, password, data, files and any other conversation between file transfer server and its clients will affect the total time required to transfer file or data, because encryption is a time consuming process. Miltchev et al. (2002) research showed that transferring 200 MB file using FTP will take almost twenty seconds and transfer the same file using SFTP will take 220 seconds that mean FTP is faster than SFTP by eleven times. They did the same comparison but using a file with the size of one GB, and they found that FTP spent approximately 450 seconds and SFTP spent approximately 1800 seconds, which means FTP is faster than SFTP by four times only. It could be found here clearly that the file size has an inverse relationship with the difference in time between FTP and SFTP. It seems that the results of this research may cause unfair judgment, because there are two processes on the file during the file transfer. The first process is processing files inside client or server which include breaking the file to packets on sender side (client or server), packets encryption on sender side if SFTP is used, and packets decryption on receiver side if SFTP is used and reassemble packets on receiver side. The second process is packets transmission through the network between the client and the server (Washburn et al., 1996; yappan et al., 2009). It is clear that there is no difference between FTP and SFTP in the second process which means the variation in time between them comes only from the first process. As a result, if more powerful and faster computers used as the client and the server time variation between FTP and SFTP will reduce. * -------------------------------------------------
Conclusion:
* -------------------------------------------------
To sum up, FTP uses two ports (21, 20), whereas SFTP uses one port (22). In addition, SFTP is more secure than FTP because it encrypts its transmission. On the other hand, FTP is faster than SFTP. As a result, the choice will be between security and speed, and in this case, the security must be the chosen one. Consequently, SFTP must be used as a file transfer server especially with confidential files, and FTP could be used only with public files only. * -------------------------------------------------
References:
1. ------------------------------------------------- Brown, L., & Gilje, M., & Jaatun I. (1992). “Secure File Transfer over TCP/IP”. TENCON '92. Technology Enabling Tomorrow: Computers, Communications and Automation towards the 21st Century.1992 IEEE Region 10 International Conference. vol. 1, pp. 494- 498. 2. ------------------------------------------------- Connolly, K. (2004) Law of Internet Security and Privacy. USA: Aspen. 3. ------------------------------------------------- Davis, R. (1978) The data encryption standard in perspective Communications Society Magazine, IEEE. November 1978, pp. 5-9. 4. ------------------------------------------------- Iyappan, P., & Arvind, K., & Geetha, N., & Vanitha, S. (2009) "Pluggable Encryption Algorithm In Secure Shell(SSH) Protocol". 2nd International Conference on Emerging Trends in Engineering and Technology (ICETET), pp 808 - 813. 5. ------------------------------------------------- Krishna, M., & Jamwal, P., & Chaitanya, K., & Kumar, B. (2011) "Secure File Multi Transfer Protocol Design". Journal of Software Engineering and Applications, vol. 4, pp. 311-315. 6. ------------------------------------------------- Kurose, J., & Ross, K. (2008). Computer networking: a top-down approach. 7. ------------------------------------------------- Liu, X., & Feng, C., & Yuan, D., & Wang, C. (2010). “Design of Secure FTP System”. International Conference Communications, Circuits and Systems (ICCCAS), 2010. pp. 270- 273. 8. ------------------------------------------------- Matthews, J. (2005). Computer networks: Internet protocols in action. 9. ------------------------------------------------- Miltchev, S., & Keromytis, A., & Ioannidis, S. (2002). “A Study of the Relative Costs of Network Security Protocols”. USENIX Annual Technical Conference, FREENIX Track. pp. 41-48. 10. ------------------------------------------------- Postel, J., & Reynolds, J. (1985). File Transfer Protocol (FTP) [Internet]. The Internet Engineering Task Force (IETF). Available: http://www.rfc-editor.org/rfc/rfc959.txt 11. ------------------------------------------------- Washburn, K., & Evans, J. (1996). TCP/IP: running a successful network. Padstow: T.J. press (Padstow) Ltd. 12. ------------------------------------------------- Ylonen, T., & Lehtinen, S. (2001) SSH File Transfer Protocol [Internet]. ]. The Internet Engineering Task Force (IETF). Available: http://tools.ietf.org/html/draft-ietf-secsh-filexfer-00 * -------------------------------------------------