SSH and TLS: Differences and Similarities

Both TLS and SSH are security protocols aimed to solve a specific set of problems.

TLS is the transport layer of HTTPS protocol while SSH is designed to replace plaintext Telnet protocol.

Architecture wise, TLS is relatively simple: It has a handshake protocol that does the authentication and agrees on a session key that will be used to encrypt the rest of the communication.

SSH is more complicated than TLS. It has the following main components:

• transport layer;

• user authentication layer;

• connection layer;

Six SSH related RFC are published in relate to SSH: 4251, 4252, 4253, 4254, 425 and 4256.

SSH Transport Layer

Transport layer handles key exchange, server authentication and sets up encryption, compression and integrity verification. It exposes to the upper layer an programmatic interface for sending and receiving plaintext data. The transport layer also arranges for key re-exchange, usually after 1 GB of data has been transferred or after 1 hour has passed, whichever occurs first.

User Authentication Layer

It handles client authentication and provides a number of authentication methods. Widely used user-authentication methods include password, publickey, keyboard-interactive, GSSAPI authentication which allows SSH to authenticate using external mechanisms such as Kerberos 5 or NTLM, providing single sign-on capability to SSH sessions.

Connection Layer

It defines the concept of channels in SSH. A single SSH connection can host multiple channels simultaneously, each transferring data in both directions. Standard channel types include: shell for terminal shells; SFTP and exec requests (including SCP transfers); direct-tcpip for client-to-server forwarded connections; forwarded-tcpip for server-to-client forwarded connections etc.

• Tls
• Ssh