8

What is the difference between SSL connection and SSL session?

This is what my lecture notes have to say which makes no sense to me (I am new to SSL):

SSL Connection:

  • A transient peer-to-peer communications link.
  • Each connection is associated with one SSL session.

SSL Session:

  • A session is an association between client and server.
  • It is created by the Handshake Protocol.
  • It defines a set of security parameters.
  • It may be shared by multiple SSL connections.
  • It is useful to avoid expensive negotiations of security parameters for each connection. Single session has many connections. Every connection has a different key

I tried googling it but the results didn't bring up anything useful.

The only thing I know is that a single SSL session can have multiple SSL connections.

Can someone explain to me in simple terms what the differences are?

8

In General:

A connection is a communication channel between a client and a server. For example: a TCP socket. Connections are usually short lived and servers are usually configured to timeout a connection if it is left idle for too long.

A session is a way of maintaining state on the server side. You can think of it as a memory chunk allocated on the server and this memory chunk is associated with a connection. Even if a connection dies, you can resume a session (using cookies in case of HTTP protocol).

You can read more about it in this whitepaper.

In context of SSL:

The same applies for SSL/TLS and for any other protocol. This is very well explained, in simple terms, in one of the results when you google it. Here you go:

Difference between connection and session is that connection is a live communication channel, and session is a set of negotiated cryptography parameters.

You can close connection, but keep session, even store it to disk, and subsequently resume it using another connection, may be in completely different process, or even after system reboot (of course, stored session should be kept both on the client and on the server).

On other hand, you can renegotiate TLS parameters and create entirely new session without interrupting connection.

| improve this answer | |
  • 1
    One might add that they refer to different levels of abstraction. The connection being the concrete entity, and the session being the time-bounded, temporal unit of context and continuity, by which you identify related work. – DTK Nov 29 '14 at 7:13
  • In addition to using a session for multiple connections separated in time -- although usually the endpoints impose a limit rarely more than a few hours -- you can also have multiple connections simultaneously "resuming" one session. Especially on today's web where a single page commonly requires tens to several hundreds of resources (HTTP transactions) browsers will commonly open and use several connections simultaneously. – dave_thompson_085 Nov 30 '14 at 5:12
  • As this was revived, I will add in TLS 1.3 since 2018 things have changed dramatically. Now there is no resumption using the same master secret, instead you can do a equally cheap handshake (1.5 RT) using a (savable) PSK derived from the first handshake but with PFS; and there is no longer any renegotiation at all, you must create a new connection to do a new handshake. (Although given the transport doesn't need to be pure TLS, this could be e.g. two STARTTLS-es.) – dave_thompson_085 Jun 5 at 2:04
0

In Layman's terms:

  • A session is a "let me in" ticket
  • A connection is an ongoing conversation

If you have a session, you can use your session ID to start a connection/conversation as long as your session is valid. A session can be a cookie, with one piece stored in your browser and the other half in the server. You present your session cookie, the server says "OK" if your session is valid and lets you talk to it.

In the case of SSL, you start off by requesting an SSL session. Let's say you log in on example.com. If you give the right credentials, example.com gives you a session cookie. You store that cookie in your browser so you don't have to type in your username & password every time you do something on example.com.

When you close your browser, your connection with example.com is terminated since you're no longer talking to it. However, you still have a session cookie. When you open example.com again in your browser, if you have a valid session ID (cookie), you can give that cookie to example.com to establish a new connection. Same session, different connection.

| improve this answer | |
-1

with in one session you can make many connections until it is alive. But remember sessions don't live for so long. example take your online banking, where when you login to the online banking and if you keep it ideal for some time, it says session is expired and it makes you to login once again. This is for security purpose and this is created by the SSL sessions.

| improve this answer | |
  • While you are describing one type of session, it is not an SSL/TLS session, which is what the question is asking about and there is some conflation in your answer of SSL sessions and other types of sessions. – Xander Jun 4 at 14:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.