SSL和SSH的不同(the differences between SSH and ssl)

SSH (Secure Shell) and SSL (Secure Sockets Layer) can both be used to
secure communications across the Internet. This page tries to explain
the differences between the two in easily understood terms.

SSL was designed to secure web sessions; it can do more, but that's the original intent.

SSH was designed to replace telnet and FTP; it can do more, but that's the original intent.

SSL is a drop-in with a number of uses. It front-ends HTTP to give you
HTTPS. It can also do this for POP3, SMTP, IMAP, and just about any
other well-behaved TCP application. It's real easy for most programmers
who are creating network applications from scratch to just grab an SSL
implementation and bundle it with their app to provide encryption when
communicating across the network via TCP. Check out: stunnel.org.

SSH is a swiss-army-knife designed to do a lot of different things,
most of which revolve around setting up a secure tunnel between hosts.
Some implementations of SSH rely on SSL libraries - this is because SSH
and SSL use many of the same encryption algorithms (i.e. TripleDES).

SSH is not based on SSL in the sense that HTTPS is based on SSL. SSH
does much more than SSL, and they don't talk to each other - the two
are different protocols, but have some overlap in how they accomplish
similiar goals.

SSL by itself gives you nothing - just a handshake and encryption. You need an application to drive SSL to get real work done.

SSH by itself does a whole lot of useful stuff that allows users to
perform real work. Two aspects of SSH are the console login (telnet
replacement) and secure file transfers (ftp replacement), but you also
get an ability to tunnel (secure) additional applications, enabling a
user to run HTTP, FTP, POP3, and just about anything else THROUGH an
SSH tunnel.

Without interesting traffic from an application, SSL does nothing.
Without interesting traffic from an application, SSH brings up an
encrypted tunnel between two hosts which allows you to get real work
done through an interactive login shell, file transfers, etc.

Last comment: HTTPS does not extend SSL, it uses SSL to do HTTP
securely. SSH does much more than SSL, and you can tunnel HTTPS through
it! Just because both SSL and SSH can do TripleDES doesn't mean one is
based on the other.

 

總而言之，SSL提供了握手和加密手段，不是一個獨立的應用程式層協議，可以基於它修改現有的應用使之安全，而SSH是基於SSL之上的應用程式層協議，跟一般的通過SSL加密的應用程式層協議只是簡單的修改socket介面替換為ssl介面的機制不同，SSH是一個完全替換telnet和ftp的應用，並且可以基於之上使用連接埠轉寄功能為其他應用程式層提供安全通道。