Session keys are the “shared keys” described above and are randomly generated by both
the client and the server during establishment of a connection. Both the client and host
use the same session key to encrypt and decrypt data although a different key is used for
the send and receive channels. Session keys are generated after host authentication is
successfully performed but before user authentication so that usernames and passwords
can be sent encrypted. These keys may be replaced at regular intervals (e.g., every one to
two hours) during the session and are destroyed at its conclusion.