1
$\begingroup$

I believe the masker key, $MK$, of a block cipher might be used for several years and is used only to encrypt $\textit{key encrypting keys}$, which in turn are used only to encrypt $\textit{data keys}$. These data keys are the ones actually used in cryptographic computations and are often also called $\textit{session keys}$. They have short lifetimes and may be used only for a single session. My questions are:

  1. What is a 'single session'?
  2. How much data might the same session key be used for (max or min?)
  3. How long would a session key be used for?

I know answers to these questions depend on many things, such what is being encrypted, how long must it remain secure, etc. but just some ideas or real-world examples would be helful.

$\endgroup$
  • 3
    $\begingroup$ Security degrades as you approach the birthday bound, i.e. $2^{b/2}$ blocks, where $b$ is the blocksize in bits. $\endgroup$ – CodesInChaos Feb 18 '18 at 9:18
  • 2
    $\begingroup$ Session keys are typically derived from the next higher-level key using a Key Derivation Function, rather than encrypted as in the question. $\endgroup$ – fgrieu Feb 18 '18 at 15:43
3
$\begingroup$

The most common encryption protocol is probably TLS, as used in HTTPS. AES (with a 128-bit block size) is probably the most common encryption algorithm. Therefore the maximum amount of data that can be sent safely is $2^{128/2}=2^{64} blocks = 256EiB$.

Typical sessions end when the user closes the web page, and so send significantly less data. Even binge-watching an entire season of a TV show on a streaming site will only use a few GiB for a session.

Of course some users rarely close their browser tabs, but the most common PC OS is Windows which updates requiring a reboot at least once a month. Thus the longest duration of a session is likely to be around a month.

This answer has ignored session resumption, because it isn't that widely used. Even where it is used most protocols (including TLS) provide a way to re-negotiate keys.

TLS 1.2 recommends that sessions last no longer than 24 hours (section F.1.4).

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.