Who generates the session keys for a SSL symmetric encryption? Is it the client for both client and server where client generates part of it while the server generates the other part?
In SSL protocol handshake both sides generate the same encryption key which is then used for the session. It is done following this procedure, in general:
- Client & server generate each a random value and send to each other
- Server sends the public key to the client
- The client generates a value called "pre-master secret" using both random values, and encrypts it using server's key, then sends it to the server
- Now both client and server have each other's random values and "pre-master secret", so basing on this information they can both generate the same session key and start using it in encrypting the following messages.