Difference between SSH and SSL

Question

Apart from enhanced authentication options offered by SSH, is there any difference between basic working of SSH and SSL protocols ?

I am asking since we can use SFTP or FTP over SSL, both would require authentication.

Answer 1

Cryptographically they are both equally secure (given that same ciphers are used). Other than that they are entirely different protocols...

Answer 2

Oranges and apples.

Answer 3

The main difference is that SSL lets you use a PKI (via signed certificates). In SSH you have to exchange the key fingerprints out-of-band. But you might want to do without a PKI anyway, in which case it's a tie.

For a nice explanation, see http://www.snailbook.com/faq/ssl.auto.html

Answer 4

SSL (or more properly, TLS) is the basic underlying encryption layer, as used by SSH, SMTPS, HTTPS, etc.

SSH is then run on top of that, and provides the authentication, session handling, and all the rest of the telnet-style "options" that an interactive login requires.

Answer 5

SSH uses SSL under the hood, so they are both as secure as each other. One advantage of SSH is that using key-pair authentication is actually quite easy to do, and built right into the protocol.

With SSL it's a bit of a mess involving CA certificates and other things. After you have the PKI in place you also need to configure your services to use the PKI for authentication instead of its internal password database; this is a nightmare on some services and a piece of cake on others. It also means you need to go to the hassle of signing all of your user's keys so they can log in with them.

Most competent users can grok SSH keys in no time but it takes a bit longer to get their heads around SSL keys (the extra CA certs and key certs confused me when I first discovered it).

Pick what's supportable. SSH+SFTP is great for Unix people, but FTP over SSL is probably easier to do if your users are Windows-based and are pretty clueless about anything other than Internet Exploiter (and you don't mind risking that your users will choose insecure passwords).