I'm trying to get a secure way of exchanging keys between my client application and the server.
The goal is to encrypt all XML messages with AES256. These XML's will be transferred to the server using https (post). yes i know the AES256 probably is overkill as it will already use HTTPS, but security is very important in my case as it is financial data i'm transferring.
The reason i use AES256 is that it is still very strong, and practically unbreakable (if implemented correctly, which is why i am here)
i have the same general idea of this question: Is this RSA/AES combination good? But i want to make the implementation safe.
my current idea:
Setup a CA (i can install the certificate on the client in a secure environment)
Client generates RSA keypair, and sends public key to server. (could also be in secured env)
Client requests key exchange (signs request with RSA)
Server generates new AES key Server encrypt key with public key of
client Server send encrypted key and signs the message with RSA
Client checks signature and decrypts key
After this i want to do a verification step, but i'm not entirely sure what the best way is for this. i was thinking of letting the client encrypt the AES key with the pub key of the server, and sign the message. then the server can decrypt again, but then i'm transferring the key again and i'm not sure if this can be a security risk.
Please note that all of these messages are already transmitted over https (with valid cert)
Is this a secure way? or is there a better/easier way?
another note: The server will not accept a new key request if that client already has one (every client has a unique ID) But if necessary the server can force the Client to generate a new key. New keys can possibly even be forced on a random time.
I just realized I forgot to explain one important thing:
The key exchange needs to happen once, after this the key needs to be stored locally. As the client application still needs to be able to encrypt messages while there is no internet connection. at that point there is a que of encrypted messages.
So it is not like I'm doing the exchange every time, but only once (or once per month) to exchange keys so that the AES encryption can continue.
