0

I was doing an exam and answered "true" to this question but the augrader said it was false

TLS derives a session key from the agreed master secret. That key is then used during the TLS session for encryption and authentication of the session data

Is this an error or is it really false ?

2

1 Answer 1

0

TLS derives a session key from the agreed master secret. That key is then used during the TLS session for encryption and authentication of the session data

It is not true that "... a [single] session key ... for encryption and authentication ..." gets derived.

While the exact details differ between TLS versions in general different keys are derived for client and server. Up to TLS 1.2 also separate keys were derived for encryption and authentication. With TLS 1.3 only the encryption key is needed since all ciphers are using authenticated encryption.

For the details see for example RFC 5246 (TLS 1.2) section 6.3 or RFC 8446 (TLS 1.3) section 7.3.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .