During a transport layer security (TLS) session, what happens immediately after the web browser creates a random PreMasterSecret?

In a standard TLS handshake using RSA key exchange, after the client (web browser) generates the random PreMasterSecret, its immediate next step is to encrypt this value. It uses the server's public key, which it received from the server's digital certificate during an earlier step of the handshake. This encrypted PreMasterSecret is then sent to the server in the "Client Key Exchange" message. This ensures that only the server, which possesses the corresponding private key, can decrypt the PreMasterSecret and subsequently derive the symmetric session keys.

A. The server decrypts the PreMasterSecret only after it has been encrypted and sent by the web browser.
B. The PreMasterSecret is a piece of random data used for key generation, not a network endpoint to which a connection can be opened.
D. This step, converting the PreMasterSecret into the final session key (Master Secret), occurs later, after the server has successfully decrypted it.

1. Dierks, T., & Rescorla, E. (2008). The Transport Layer Security (TLS) Protocol Version 1.2. RFC 5246. Internet Engineering Task Force. Section 7.4.7.1, "Client Key Exchange Message," states: "a 48-byte PreMasterSecret is generated by the client, encrypted under the server's public key, and sent to the server."

2. Comer, D. E. (2018). The Internet Book: Everything You Need to Know about Computer Networking and How the Internet Works (5th ed.). CRC Press. Chapter 33, "Securing TCP Connections With TLS," describes the process where the client encrypts a secret using the server's public key.