Master keys' strengh If I am going to use a master key to generate a session key, why the master key must be "stronger" than the session key?

Like should not be distributing 128-bit AES keys derived from a 56-bit DES key.
The master key has to be stronger in the sense that it's more sensitive than session keys.

The information used to derive session keys are not necessarily secret, so if it's easy to recover the master key, an attacker will be able to compute all the derived keys.

On the other hand, recover a single session key will not help you to recover the master key and so other session keys.

Thus, the effective security strength of the session keys is limited by the effective security strength of the master key.



Say you have:

$$K_{session, i} = \operatorname{KDF}(K_{master}, I)$$

where


$\operatorname{KDF}$ is a one way Key Derivation Function;
$I$ is non-secret key derivation information and
$K_{session, i}$ is a session key derived from a specific $I$.


It's not possible to recalculate $K_{master}$ from $K_{session}$ because the $\operatorname{KDF}$ is one way.

You can however brute force $K_{master}$ together with a known $I$ to derive any $K_{session, i}$.