Session key
From Wikipedia, the free encyclopedia
A session key is a single-use symmetric key used for encrypting all messages in one communication session. A closely related term is traffic encryption key or TEK, which refers to any key used to encrypt messages as opposed to different uses, such as encrypting other keys (key encryption key)
Session keys introduce complication in a crypto system, normally to an undesirable end. However, they also help with some real problems, which is why they are used. There are two primary reasons for session keys:
- First, several cryptanalytic attacks are made easier as more material encrypted with a specific key is available. By limiting the material processed using a particular key, those attacks are made more difficult.
- Second, asymmetric encryption is too slow for general purpose use, but many otherwise good encryption algorithms require that keys be distributed securely before encryption can be used. All secret key algorithms have this undesirable property. By using asymmetric encryption to distribute a secret key for another, faster, symmetric algorithm, it's possible to improve overall performance considerably.
Like all cryptographic keys, session keys must be chosen so that they are unpredictable by an attacker. In the usual case, this means that they must be chosen randomly. Failure to choose session keys (or any key) properly is a major (and too common in actual practice) design flaw in any crypto system.
