Search code examples
javasslhttpstomcat8jsse

How do I get symmetric key generated in SSL handshake?


During SSL handshake the client encrypts generated pre-master secret with the server's public key and sends to the server. Both Server and Client perform steps to generate the master secret with the agreed cipher. Both the client and the server use the master secret to generate the session keys, which are symmetric keys used to encrypt and decrypt information exchanged during the SSL session

http://www.symantec.com/connect/blogs/how-does-ssl-work-what-ssl-handshake

How do I get that symmetric key, so that I can store that into database and use the same every time client connects?

Both the server and client should save that key and never do handshaking process again. Next time(even after disconnecting) they should directly start the communication using symmetric key over https.

In short, I want SSL session to last forever.

EDIT Android device is the client. Client-Server exchange only few bytes data whenever client gets online. SSL is overhead in this case, isnt it ?


Solution

  • How do I get that symmetric key

    You can't in Java.

    so that I can store that into database and use the same every time client connects?

    You can't in SSL.

    Both the server and client should save that key and never do handshaking process again.

    You can't. It would be insecure.

    Next time(even after disconnecting) they should directly start the communication using symmetric key over https.

    You can't.

    In short, I want SSL session to last forever.

    You can't, and you don't want to. It would be insecure.

    SSL is overhead in this case, isnt it?

    Such questions are meaningless. Compared to what? You can't compare a secure solution to an insecure solution. If you don't want security, don't use SSL.