I programmed an application on Linux using C, I added an authentication and cryptography layer that's going like this :
1 -client sends connection request. -server send a random challenge to client. -the client adds a salt to the challenge and hash it using SHA1 then sends it. -the server adds the same salt and hash the challenge with SHA1, and compare the received result.
2 -In the positive case, the server asks the client for login and password. -the client sends the login and password(salted and hashed with sha1) . -the server search for the login and hashed password in a file .
3 -If the client has sent a valid login and password, he is authenticated. -A key session is generated by concatenating The hashed challenge received And the hashed password..
4 -the key session is used to encrypt data with AES256
I want you to tell me what do you think about it, Is it secure ? Is there any attacks that can break that sequences in any step...? Thank you so much.