Implicit vs Explicit TLS in FTPS

The secure extension of FTP otherwise known as FTPS take its root from 1997 with RFC959 and was later refined in 2001 before taking its latest form in 2005 with RFC4217. Those RFCs have defined various modes for FTPS known as Implicit and Explicit TLS.

Before we dive in, the gist of Explicit vs Implicit lies in the name, with explicit, the FTP client need to request the usage of a secure communication exlicitly whereas in implicit mode it is already assumed the connection to the server must happen through TLS like you would do on your browser when visiting an HTTPS website.

Recap on TLS

In TLS we need to go through a serie of steps to initiate the secure connection, first of we need to get through a TCP Handshake to establish the connection between the client and the server. When the connection is established we must initiate a TLS Handshake which starts with the client sending a “Client Hello” message.

That’s all we need to know about TLS to fully grasp the difference between Explicit and Implicit TLS but if you want to dig deeper and enter the wonderfull world of TLS1.3, RSA, Diffie Hellman, you can checkout this introduction video on TLS:

Implicit TLS

When you visit an HTTPS website, your browser choose by default to implicitly use port 443 and the entire connection is made from there. That’s exactly the same with FTPS with Implicit TLS except it’s not port 443 that was registered to the IANA but port 990.

By the moment the TCP handshake completes and the connection is established, the TLS handshake must start with the client sending a TLS Hello to the server. In the case where such message isn’t received, the server will drop the connection:

Effectively, Implicit TLS prevents client from using an insecure connection either by mistake or lazyness as the connecting client must understand TLS to be able to do anything on that server:

In practice, Implicit TLS is the lesser use TLS mode when it comes to FTPS as the IETF did deprecate it: “This approach is not favoured by the IETF and should not be used for new FTP-TLS implementations.”

Explicit TLS

This mode doesn’t have a dual in the HTTPS world. The idea behind explicit is you start connecting to your FTPS server like you would do on your FTP server, typically on port 21 and then ask the server to switch to a secure connection using the AUTH command.

It’s only from that point onward that client can initiate the TLS handshake by sending the TLS Hello. AUTH TLS isn’t the only available security mechanism, it’s the most popular but they were some other ones like “AUTH SSL” which got deprecated in 2001 and GSSAPI which is defined in RFC2228