In a SSL session between a client and a server, who is responsible for generating the master secret that will be used as a seed to generate the symmetric keys that will be used during the session?

Question

Options

• ABoth client and server
• BThe client's browser
• CThe web server
• DThe merchant's Certificate Server

• A
  2% (1)
• B
  88% (37)
• C
  7% (3)
• D
  2% (1)

Explanation

In the SSL/TLS handshake, the client's browser generates a random pre-master secret and encrypts it with the server's public key (obtained from the server's certificate), then sends it to the server. Only the server can decrypt it using its private key. Both the client and server then independently derive the same master secret by combining the pre-master secret with random nonces exchanged earlier in the handshake. From the master secret, both sides derive the symmetric session keys used for encrypting the actual session data. The client's browser initiates this process and generates the pre-master secret that seeds everything downstream.

No community discussion yet for this question.