Kerberos (and I assume other Trusted Third Party protocols) use (hash) an existing shared secret key to create a session key used for authentication. I read that this authentication secret key can then be used to create another secret key to be used as the session key for authentication.

"If a message integrity or confidentiality key is required, a Kerberos sub-key or a Kerberos session key from the Kerberos ticket is used. A key can be derived from either the Kerberos sub-key or the Kerberos session key." https://www.ibm.com/docs/en/was-nd/9.0.5?topic=token-kerberos-usage-overview-web-services.

Is that true and if so, how is this done? Or why can't the auth session key also be used as the session key for encryption?

Kerberos (and I assume other Trusted Third Party protocols) use (hash) an existing shared secret key to create a session key used for authentication. I read that this authentication secret key can then be used to create another secret key to be used as the session key for message encryption.

"If a message integrity or confidentiality key is required, a Kerberos sub-key or a Kerberos session key from the Kerberos ticket is used. A key can be derived from either the Kerberos sub-key or the Kerberos session key." https://www.ibm.com/docs/en/was-nd/9.0.5?topic=token-kerberos-usage-overview-web-services.

Is that true and if so, how is this done? Or why can't the auth session key also be used as the session key for encryption?