1
$\begingroup$

i have understood the SSL handshake flow .The confusion are -

  1. What is the pre-shared key here ? Is it the pre-master key or it is the random number that is generated by server and client.?

    2.I get it that the session key is used to maintain the session but how does it so that in TLS/SSL

  2. how master key is different than session key

$\endgroup$

1 Answer 1

3
$\begingroup$

What is the pre-shared key here ? Is it the pre-master key or it is the random number that is generated by server and client.?

Neither. In SSL/TLS 'Pre-Shared Key' (PSK) is a specific type of key-exchange different from the common RSA or DHE/ECDHE key-exchanges, and practically never used on the public net. (There are similar, but not identical, PSK options in some other protocols like IPsec.)

The premaster secret is not called a key and not used as a key, although it has some key-like properties. It is secret, and it is shared, but it is shared during the handshake and not before, so it is not pre-shared. The premaster secret and the two 'random' values are used to derive the master secret, and the master secret with the 'random' values again is used to derive the working or session keys and IVs, plural, see next.

get it that the session key is used to maintain the session but how does it so that in TLS/SSL

how master key is different than session key

There is not one session key; there are at least two and usually four or six if you count the IVs (or nonces) handled as keys. See What is the purpose of four different secrets shared by client and server in SSL/TLS? and rfc5246 (or previous versions) sections 8.1 6.3 and 5

$\endgroup$
1
  • $\begingroup$ Also note that starting with TLS 1.3, the PSK handshakes will replace the session resumption protocol from previous TLS versions, meaning we're going to see PSK handshakes a lot more often. $\endgroup$
    – SEJPM
    Commented Mar 2, 2017 at 12:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.