dependently calculate the MAC and encryption keys. This is done by both parties using the same Key Derivation Function (KDF) in order to derive the same master secret, which will subsequently be used to generate the actual cryptographic keys. 5. The handshake process is concluded by first having the client calculate a MAC of all the hand- shake messages and then send it to the server. 6. The server calculates and sends a MAC of all the handshake messages to the client. The load is heavier at session setup time than during the actual data transfer phase where encryp- tion/decryption acceleration is desirable. SSL accelerators are therefore needed where it makes sense to introduce them-for example, at servers or gateways. The SSL protocol sometimes allows the use of a significantly accelerated variant called resump- tion or resume handshake, where the parties agree to use the same master secret from a previous ses- sion and therefore forego the time spent starting cryptographic calculations again from scratch. According to Rescorla, this has been shown to accelerate the session setup by almost a factor of 20 in the case of session keys that are 512 bits long. This special resume handshake should only be used in cases where the convenience of some types of frequent connections for specific client devices out- weighs the security concerns; therefore, it should only be engaged judiciously. Downloaded from Digital Engineering Library @ McGraw-Hill (www.digitalengineeringlibrary.com) Copyright © 2004 The McGraw-Hill Companies. All rights reserved. Any use is subject to the Terms of Use as given at the website. SECURITY COPROCESSORS SECURITY COPROCESSORS 389 SECURITY COPROCESSORS: A CLASSIFICATION Security coprocessors come in many forms and shapes. Users can offload computationally intensive cryptographic operations to specialized chips. This has been the case from the original DES encryp- tor chips in the early 1990s from companies like VLSI Technology (now Philips Semiconductor) the latest coprocessors like SafeNet's 