I am far from being a security expert, so please forgive any approximation in this question.
As I understand it from this (very good) answer, a suite of HTTPS connection can be summarized as such :
- There's a negotiation between the browser and the server that uses expensive asymmetric cryptography that results in a shared master secret that will last for the time of a "session", time which is decided by the server.
- Each subsequent connection is then encrypted with a fast symmetric cryptography algorithm whose key is inferred from the master secret. Therefore each connection is encrypted with a different key so any "sniffer" would not have enough data to find either the specific connection key or the master secret.
Now, I'm working on an application that will use web sockets that may stay connected for very long periods of time. By very long, I mean several days. The informations that will transit through this web socket connection will be highly confidential.
So, knowing that a WebSocket should never disconnect, is there something in the WSS specification to periodically renew the symmetric key ?
As I understand it, with a symmetric algorithm, the more data are encrypted with the same key, the weaker the encryption becomes.
HTTPS changes this key (infers a new one from the master secret) at each new connection, but what about a WebSocket connection where there's only one connection for a long period of time ?