Who generates the session keys for a SSL symmetric encryption? Is it the client for both client and server where client generates part of it while the server generates the other part?


In SSL protocol handshake both sides generate the same encryption key which is then used for the session. It is done following this procedure, in general:

  1. Client & server generate each a random value and send to each other
  2. Server sends the public key to the client
  3. The client generates a value called "pre-master secret" using both random values, and encrypts it using server's key, then sends it to the server
  4. Now both client and server have each other's random values and "pre-master secret", so basing on this information they can both generate the same session key and start using it in encrypting the following messages.

See detailed protocol description for more in-depth explanation.

  • 2
    is this something like diffie hellman key exchange protocol ? – user1157 Jan 23 '11 at 12:34
  • DH can be used as key exchange protocol, yes. Usually DH is used when there's no certificates in play and RSA if there are certificates. See httpd.apache.org/docs/2.0/ssl/ssl_intro.html – StasM Jan 23 '11 at 12:35
  • This is not accurate. The random values + premastersecret are never sent in the clear; the random value that the client generates gets encrypted using the server's public key. Most of the rest is correct, though I'm hoping @Thomas will clarify some of the subtler details... – AviD Jan 23 '11 at 18:25
  • 1
    @AviD: sorry, I was away for a couple of weeks. In SSL, both client and server send random blurbs in the clear. They also run a key exchange protocol which results in a premaster secret (with RSA, the client chooses the premaster and encrypts it with the server public key; but they can also use Diffie-Hellman). The actual encryption and MAC keys are derived from the premaster and the client and server randoms. – Thomas Pornin Feb 7 '11 at 11:04
  • @StasM: DH without certificate is vulnerable to active MITM attack. You still need a certificate to prove your identity in DH. – Lie Ryan Dec 19 '16 at 0:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.