通过互联网从客户端向服务器安全发送加密文件的行业标准是什么？ [关闭]

Question

I'm currently building a filesystem written in Go that sends files from a client to server, in encrypted format. I am very new to information transfer protocols.

I want to send information about the user (username, password hashed with bcrypt) to a server, which would then open a secure session of some type with the client where the server and client could send and receive file data and metadata. This should keep a backup of the client's files on the server, and encrypted with a symmetric key unique that is unique to that user (with AES256 or similar). I want all of this to happen as a background task, without input from the user aside from the user/pass at startup.

• What would be the best protocol to transfer (encrypted) files? TCP, SSH, SFTP, or something else?
• What about transferring metadata about files?
• What is the best way to authenticate a user before opening a session (for this case)? Using certificates or password hashes created from bcrypt?

Answer 1

SSL/TLS is standard. You would need to enable that with a valid certificate from a certificate authority on your domain i.e. https rather than http. Once you have the SSL connection established all communication will be encrypted preventing man-in-the-middle attacks. The standard way to authenticate a user is username/password or any variation of that type i.e. email/password. You can also you OAuth for authentication. Store the passwords as hashes on your server.

Update:

This article discusses the importance of choosing the correct hashing algorithm. Common hashing algorithms such as MD5 and SHA1 are vulnerable to certain attacks and suffer from collisions. Much more cryptographically strong algorithms have been developed such as bcrypt.