# In this example, which is a premaster secret, and which is a master secret?

In the context of this data, as shown in the image below, which one is a pre-master-secret and which one is a master-secret. It looks to me as if the final value of 2, for Alice and Bob is a master-secret which can be then used for creating a symmetric key (AES). Am I right?

1. Alice and Bob agree to use a prime number $p=23$ and base $g=5$.
2. Alice chooses a secret integer $a=6$, then sends Bob $A=g^a\mod p$
• $A=5^6\mod 23$
• $A=15,625\mod 23$
• $A=8$
3. Bob chooses a secret integer $b=15$, then sends Alice $B=g^b\mod p$
• $B=5^{15}\mod 23$
• $B=30,517,578,125\mod 23$
• $B=19$
4. Alice computes $s=B^a\mod p$
• $s=19^6\mod 23$
• $s=47,045,881\mod 23$
• $s=2$
5. Bob computes $s=A^b\mod p$
• $s=8^{15}\mod 23$
• $s=35,184,372,088,832\mod 23$
• $s=2$
6. Alice and Bob now share a secret (the number $2$) because $6$ x $15$ is the same as $15$ x $6$.
-
This is Diffie-Hellman key exchange with artificially small $p$. One thing is misleading: for $p$ of practical interest, that is of some thousand(s) bits, when computing $g^a\bmod p$, one does not computes $g^a$ then reduce $\bmod p$; $g^a$ is simply too huge. Note: I do not know a standard usage of the terms master key or pre-master key in this context. –  fgrieu Jan 5 at 17:59
Thanks for your reply but it doesn't answer my question. I think the master key is probably the 2 that's in the end and the pre-master the numbers 6 and 15, but I am not sure, hence the question was asked to solicit expertise. –  Ali Gajani Jan 5 at 18:03
Perhaps try the obvious search –  fgrieu Jan 5 at 18:06
I did, didn't get the hang of it. Waiting for my fellow Crypto users to answer. –  Ali Gajani Jan 5 at 18:16
If the question is about terminology, I would have to agree with @fgrieu ; the terms "premaster key" and "master key" are not standard terminology; at the least, I've never heard of them either. It might be terminology someone made up; if so, you'd have to ask them what they meant. The closest standard terms I can think of is the TLS terms "premaster secret" and "master secret" (which are intermediate values derived during the TLS key exchange protocol, and differ from what you have referenced) –  poncho Jan 5 at 19:07
show 1 more comment

The protocol outlined in the question is Diffie-Hellman key exchange with artificially small $p$. Beware that one thing is misleading in this exposition: for $p$ of practical interest, that is of some thousand(s) bits, when computing $g^a\bmod p$, one does not computes $g^a$ then reduce $\bmod p$ as shown, because $g^a$ is too huge. Instead, one reduces $\bmod p$ (at least) after each multiplication. Approximately ${3\over 2}\cdot\log_2a$ modular multiplications are performed in the simplest algorithm used in practice.

Thanks to poncho's comment, we know that the terms premaster secret and master secret are used in TLS, as:

8.1. Computing the Master Secret

For all key exchange methods, the same algorithm is used to convert the pre_master_secret into the master_secret. The pre_master_secret should be deleted from memory once the master_secret has been computed.

  master_secret = PRF(pre_master_secret, "master secret",
ClientHello.random + ServerHello.random)
[0..47];


The master secret is always exactly 48 bytes in length. The length of the premaster secret will vary depending on key exchange method.

8.1.1. RSA

When RSA is used for server authentication and key exchange, a 48- byte pre_master_secret is generated by the client, encrypted under the server's public key, and sent to the server. The server uses its private key to decrypt the pre_master_secret. Both parties then convert the pre_master_secret into the master_secret, as specified above.

8.1.2. Diffie-Hellman

A conventional Diffie-Hellman computation is performed. The negotiated key (Z) is used as the pre_master_secret, and is converted into the master_secret, as specified above. Leading bytes of Z that contain all zero bits are stripped before it is used as the pre_master_secret.

Note: Diffie-Hellman parameters are specified by the server and may be either ephemeral or contained within the server's certificate.

Thus, in the protocol of the question, which can be seen as a reduced example of Diffie-Hellman as it would be used in TLS, $s$ is the pre_master_secret; the master_secret would be derived from it.

-