Like all cryptographic keys , session keys must be chosen so that they are unpredictable by an attacker . In the usual case , this means that they must be chosen randomly . Like all cryptographic keys , session keys must be chosen so that they can not be predicted by an attacker , usually requiring them to be chosen randomly .