Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
I studied about SSL/TLS and learned that client and server must share keys below.
Then, in SSL/TLS, a client doesn't send these keys to server directly, but it sends pre master secret and generates keys from it. This is why?
The point of a premaster secret is to provide greater consistency between TLS cipher suites. While RSA cipher suites involve the client sending a random 48-byte premaster secret directly to the server, other suites do more complex things to generate the secret, and end up with a secret that might have some structure to it. For instance, (EC)DH suites use (elliptic curve) Diffie-Hellman to negotiate the secret; the output of this can be longer or shorter than 48 bytes, and it might potentially be poorly distributed (which could be bad). For PSKs, it's even worse - the premaster secret basically is the PSK. For various reasons, it's nice to have the master secret be some consistent format; it lets you separate the key-exchange side from the encryption side. Likewise, it's nice to have the master key be pseudorandom.
While you could require key exchange mechanisms to output the master secret directly meeting specific requirements, just about every key exchange system would do it the same way anyway (i.e. pass the negotiated value through the TLS PRF). Since most key exchange methods result in a shared secret that needs some transformation, and that transformation works well for basically every key exchange method, they just put it in the TLS spec for all methods to use.
