If I am going to use a master key to generate a session key, the master key must be "stronger" than the session key.
For instance, I should not be distributing a 128-bit AES keys with a 56-bit DES key.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
I should not be distributing a 128-bit AES keys with a 56-bit DES key. Why?
If you think about this, it is trivially obvious: anyone can obtain the 128 bit key by brute forcing the 56 bit key that you distribute it under. The performance of your security is defined by the weakest point in the system.