Why does the TLS protocol use different symmetric keys for receiving and sending data?
Isn't it enough to have a single key used for both reading and writing?
1 Answer
$\begingroup$
$\endgroup$
Well, whether it would be safe to use the same keys to encrypt and to decrypt depends a great deal on the ciphersuite. In particular, TLS supports ciphersuites where it would cause a serious security problem; hence TLS was designed to have different keys in two directions (so that it could use those ciphersuites safely).
In particular, the RC4 encryption algorithm would be insecure if the same key was used in both directions. This is because, if both directions used the same key, then the same keystream would be used to encrypt both sides; that means if the attacker heard both sides of the communication, and exclusive-or'ed the corresponding bytes from both directions, he would get the exclusive-or of the two plaintexts. This is a serious security problem; at the simplest level, if he could guess one side's half of the communication, he can recover the other side.
For one trivial example, consider a TLS-protected communication where the server sent the fixed string "Enter password:" (or the XML equivalent), and the client then sent the password, well, the attacker could exclusive or the two together, and recover the password.
Obviously, this is not acceptable. By using two different keys for the two directions, both directions are encrypted using independent keystreams, and so the attacker cannot do this.
