Session Key
- •
def
- •
a temporary symmetric key generated for a single communication session, used to encrypt that session's data
- •
- •
how it's established
- •
the client encrypts a random symmetric key using the server's public key; the server decrypts it with its private key and both sides now share the same key — this shared value becomes the session key
- •
can also be derived directly via Diffie-Hellman Exchange key agreement, without ever transmitting the key itself
- •
- •
implementation notes
- •
should be ephemeral — changed often — and unpredictable
- •
- •