Understanding a session key

It is important to understand how asymmetric encryption is used in practice. Asymmetric ciphers, such as RSA, are much slower than symmetric ciphers, such as AES. Therefore, usually, the actual data that a sender wants to encrypt is not encrypted by RSA. Instead, the sender generates a symmetric session key. Then, the actual data is encrypted by a symmetric algorithm, such as AES, with the session key, which is encrypted by RSA. When decrypting, the recipient first decrypts the session key by RSA and then decrypts the actual data by AES with the session key. Such an encryption scheme is often referred to as a hybrid encryption scheme.

In secure network protocols, such as TLS, SSH, and IPsec, the communication session begins with the handshaking operation, part of which is the key exchange operation. In the older versions of the protocols, the key exchange operation involved the generation of the session key by one party of the communication, encrypting...