Possible Duplicate:
network communication encryption in java
I am designing a client server application. I want the whole session to be encrypted. I was thinking the following precudure to do that(using RSA for public-key encryption and AES-128 for symmetric encryption):
Client connects to server and send a ‘hello’ message.
Server responds with it’s public key.
Client generates an 128-bit AES key, and sends it encrypted with the server’s public key.
The rest of the application protocol is encrypted using the AES key.
Is this logic ok? Are there any flaws? Will it be okay or it’s better to use SSL? Basically what i am concerned are replay attacks and mitm.
What you are doing is describing the underlying idea of SSL, and as there are many tiny mistakes you can make implementing the scheme, you would be much better off using SSL.
Your scheme would be flawed as you describe it because you don’t have any method of verifying the public key of the server. Anyone could have send it. Furthermore, how do you know that the encrypted AES key is actually generated by the client? Anybody may intercept the public key. This is why SSL (or now TLS) uses a truststore and Diffie-Hellman as well, among other tricks.
You can use a self signed certificate which you can trust in some out-of-band procedure (such as distributing with the client app) if you don’t want to buy one.