This question already has an answer here:
- How does SSL/TLS work? 3 answers
I have read that a session key is symmetric, and it is encrypted by recipient's public key;
When "Bob" receives a message, does he decrypt it with his private key and he's then in possession of an encrypted message and a session key, which he then uses to decrypt the message?
If my understanding is correct, anyone in possession of Bob's private key can easily determine the session key and decrypt the message. Or did I misunderstand this?