client-specific key stream
The client-specific key stream is the encrypted form of the master key stream. The master key stream is encrypted with the public key contained in an encryption certificate, specifically issued for one or more client machines. Only the client machines that have the encryption certificate installed have the required private key to decrypt the encrypted key stream.
