I'm currently studying secret key cryptography, and I've come across the terms "long-term key" and "session key".
What's the difference between these two kinds of keys?
$\begingroup$
$\endgroup$
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
First, understand that keys need to last only as long as you need to recover what they are protecting. If you are storing a secret in a box until next year, you have to keep the key until next year. But if we're talking on the phone, we only have to keep the key for the duration of the phone call.
If Alice and Bob are going to speak securely, they don't need to keep the shared secret key around for a long time. They only need it for as long as they're speaking. And they don't want someone who records their conversation to be able to learn what they said. If they agree on a temporary key, one that lasts only as long as their conversation, that is a session key.
A session key is one that is not intentionally stored, and is not re-creatable. Session keys are used only for communications protocols, never for storage purposes. In computer protocols like SSL, the session key is generated randomly, exchanged securely with the other computer (using a key exchange protocol like DH), and remains in each computer's memory only for the duration it is needed (a session.) When the session is ended, both sides wipe their copies of the key from memory.*
A long-term key is one that is deliberately stored somewhere, either on a computer disk, flash memory, or even printed on paper. The key is intended to be used at multiple points in time, such as "I will use this key to encrypt this secret file today, and use it again to decrypt my secret next week." A long term key can be used for any purpose, including stored information as well as transient communications.
* Note that an attacker can certainly record the session key exchange, and if they can break the key exchange cryptography they can decrypt the session key.
