I realized all of the phase of the handshake but I do not understand how it does that from the two randomly generated numbers are unable to generate a session key that the client and the server uses for symmetric encryption . if someone explain to me how it works I would be very grateful
This is being done by using the
- Diffie-Hellman key exchange protocol when you aim for Forward Secrecy (Authentication-Key = RSA, Encrpytion-Key = DH-negotiated)
- RSA in non Forward Secrecy scenarios (Authentication/Encryption-Key = RSA).
The latter has the disadvantage that an attacker that can get hold of your private key can also decrypt all past communication - whereas this is not possible by using DH and therefore a different key for encryption.