In most cases, SSL should be sufficient. If the server's certificate and private key are stored securely, certificate revocation is checked regularly, the private key is not weak (and so on...), the channel between the end user's browser and your server (as well as the one between the master and the slave sites) will be protected from eavesdropping, preventing others from seeing the credentials.
What SSL does not do is authenticating the "client" side of the connection, that is, anyone knowing the right URLs could connect, authenticate (impersonating a slave site) and obtaining an authentication/login token (if the supplied credentials are correct). This implies that, given a token, your master server would only not be able to discriminate which site is performing "privileged" functions. The credentials themselves would remain protected by SSL, and the attacker would still need to know them to perform the attack. (I have assumed there are no other bugs in the sites themselves, like XSS vulnerabilities or incorrect cookie management).
That said, you should use a key (or a secret in form of a string) and pass it from the slave sites to the master one only if you need to manage permissions inside this network at a great level of detail (like preventing login on certain sites and allowing it on others based on the user's identity, or temporarily deny logins to certain sites if some of them are not under your direct control and you suspect compromise); if that's the case, I suggest you take a look at the OAuth site, it's a protocol designed exactly for that purpose (you could simply write an API that allows logins and retrieves necessary data from the master server).
If (and only if) all the sites are under your direct control, using just SSL should be enough; the burden to manage two sets of keys (one for SSL and one for additional encryption) would be too high, and the servers would use too much resources. Only make sure SSL is used between the browsers and the servers as well as for all communication between the servers themselves, to defend against network sniffing.