RE: sFTP question

You don't need a user ID and password to use HTTPS.  HTTPS encrypts the data
stream based on a certificate.  You DO need an SSL certificate on the
server, and the client needs to recognize that certificate.  They then use
the cert to exchange data.

HTTPS is often used in conjunction with authentication, but not always.  You
can have any combination of authentication and encryption.  An example of an
anonymous encrypted session would be a storefront.  You go to the page and
select some items.  This part is anonymous (you haven't logged in) and also
unencrypted.  Then you hit the "checkout" button.  You still haven't logged
in, but you are sent to a secure page to enter your credit card information.

Note that lots of store fronts also allow you to log in.  This is to get
your preferences.  But the majority of the simpler sites don't do that; they
just have a little secure form to enter your CC info.

Joe

From: AGlauser@xxxxxxxxxxxx

Mike Cunningham wrote on 17/11/2006 08:41:23 AM:

My understanding of it is that sFTP is to FTP like HTTPS is to HTTP. All
data passing over FTP is in clear text. Data passing over sFTP is
encrypted.

Which leads me to believe that some sort of key exchange is required to do
userid/password authentication, as well as non-interactive authentication.
 So does that mean that keys need to be set up either way?