Ethical Hacking Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package. | Computer Forensics Training at InfoSec Institute Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. |

| Subject: | Re: SFTP and FTPS |
|---|---|
| Date: | Fri, 29 Dec 2006 08:13:35 -0800 |
If sftp uses keys instead of certificates, what kind of keys are used and why can't they take advantage of chains of trust? If this statement isn't true please explain what's wrong with it.SFTP uses SSH keys, which are generated completely by the client, not a certificate authority. Chains of trust don't apply because there is no third party involved.
The other question concerns "SFTP clients must install keys on the server". (Again, if this is true) What are they talking about? I've done some reading in the SSH RFCs and, as best as I can tell, the client is the one accepting and verifying the server key (I'm not so sure I have a firm grasp on all that the RFCs are saying). If this is true why are clients installing keys on the server?The client's public key is installed on the server so that the server knows which clients are allowed to connect to it.
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Next by Date: | Re: SFTP and FTPS, Leif Nixon |
|---|---|
| Next by Thread: | Re: SFTP and FTPS, Leif Nixon |
| Indexes: | [Date] [Thread] [Top] [All Lists] |