A session key is a key used to secure a single, relatively short episode of
communication: a session. Each distinct session between a pair of participants uses a new session key, which is always a symmetric key for
speed. The participants determine what session key to use by means of a
protocol—a session key establishment protocol. A session key establishment protocol needs its own security (so that, for example, an adversary
PETERSON-AND-DAVIE 14-ch08-632-695-9780123850591 2011/11/1 22:24 Page 648 #17
648 CHAPTER 8 Network security
cannot learn the new session key); that security is based on the longerlived predistributed keys.
There are several motivations for this division of labor between session
keys and predistributed keys:
■ Limiting the amount of time a key is used results in less time for
computationally intensive attacks, less ciphertext for cryptanalysis,
and less information exposed should the key be broken.
■ Predistribution of symmetric keys is problematic.
■ Public key ciphers are generally superior for authentication and
session key establishment but too slow to use for encrypting entire
messages for confidentiality.
This section explains how predistributed keys are distributed, and
Section 8.3 will explain how session keys are then established. We henceforth use “Alice” and “Bob” to designate participants, as is common in
the cryptography literature. Bear in mind that although we tend to refer
to participants in anthropomorphic terms, we are more frequently concerned with the communication between software or hardware entities
such as clients and servers that often have no direct relationship with any
particular perso