For development on a mobile or embedded device that supports SSH. For securing file transfer protocols. File transfer protocols The Secure Shell protocols are used in several file transfer mechanisms. Secure copy (SCP), which evolved from RCP protocol over SSH rsync, intended to be more efficient than SCP. Generally runs over an SSH connection. SSH File Transfer Protocol (SFTP), a secure alternative to FTP (not to be confused with FTP over SSH or FTPS) Files transferred over shell protocol (FISH), released in 1998, which evolved from Unix shell commands over SSH Fast and Secure Protocol (FASP), aka Aspera, uses SSH for control and UDP ports for data transfer. Architecture The SSH protocol has a layered architecture with three separate components: The transport layer () typically uses the Transmission Control Protocol (TCP) of TCP/IP, reserving port number 22 as a server listening port. This layer handles initial key exchange as well as server authentication, and sets up encryption, compression, and integrity verification. It exposes to the upper layer an interface for sending and receiving plaintext packets with a size of up to 32,768 bytes each, but more can be allowed by each implementation. The transport layer also arranges for key re-exchange, usually after 1 GB of data has been transferred or after one hour has passed, whichever occurs first. The user authentication layer () handles client authentication, and provides a suite of authentication algorithms. Authentication is client-driven: when one is prompted for a password, it may be the SSH client prompting, not the server. The server merely responds to the client's authentication requests. Widely used user-authentication methods include the following: password: a method for straightforward password authentication, including a facility allowing a password to be changed. Not all programs implement this method. publickey: a method for public-key-based authentication, usually supporting at least DSA, ECDSA or RSA keypairs, with other implementations also supporting X.509 certificates. keyboard-interactive (): a versatile method where the server sends one or more prompts to enter information and the client displays them and sends back responses keyed-in by the user. Used to provide one-time password authentication such as S/Key or SecurID. Used by some OpenSSH configurations when PAM is the underlying host-authentication provider to effectively provide password authentication, sometimes leading to inability to log in with a client that supports just the plain password authentication method. GSSAPI authentication methods which provide an extensible scheme to perform SSH authentication