Note In some situations the same symmetric key is used for encrypting all messages for the entire duration of a session e.g. with WS-SecureConversation , kerberos tokens, SAML Holder of key with symmetric key. But in these cases the best practice is to not use the session key directly for content encryption, instead one should derive a fresh content encryption key from the session key for every m