Hey,
There are two questions in there, I believe:
1. Why do we use 4 different keys? Why not just two? Or just one? Based on what we said in class, one key would be enough. However, in principle, it's better to decouple the mechanisms used for confidentiality and authenticity, as well as the mechanisms used to secure queries and responses. One reason is that, in the past, using the same mechanism for confidentiality and authenticity led to unpredictable vulnerabilities. Another reason is that, using different keys simply improves security (e.g., if one key gets compromised, only one aspect of the protocol is compromised, not everything).
2. Why do *both* sides create the 4 keys? It's the same 4 keys. It's just that each side creates the keys on its own. It would have been equivalent for one side to create the keys and send them to the other side (encrypted and authenticated with the master key). However, since the 4 keys are created from the master key, each side can create them on its own, without communicating with the other side, which is faster.
Clear?
