The team of developers I am part of is trying to develop a safe way to exchange sensitive data between a server and mobile devices.

We have come up with the following algorithm:

1. Device generates private RSA key, and sends the public key to server.

2. Server generates unique to user AES key and uses the RSA public key to encrypt it and send it back to device.

3. Device gets the AES key. Uses it to encrypt password and username and sends it to the server.

4. Server decrypts the username and password. If there is a match, the AES key is used for secure communication for X amount of time or until log-out. Else, the process must be restarted.

Is it safe enough? Are there ways it can be improved? What are the faults?

Edit: After reading the comments, what is a safer alternative and why?

The team of developers I am part of is trying to develop a safe way to exchange sensitive data between a server and mobile devices.

We have come up with the following algorithm:

1. Device generates private RSA key, and sends the public key to server.

2. Server generates unique to user AES key and uses the RSA public key to encrypt it and send it back to device.

3. Device gets the AES key. Uses it to encrypt password and username and sends it to the server.

4. Server decrypts the username and password. If there is a match, the AES key is used for secure communication for X amount of time or until log-out. Else, the process must be restarted.

Is it safe enough? Are there ways it can be improved? What are the faults?

Edit: After reading the comments, what is a safer alternative and why?

Edit2: Ok, i get it. I won't use my own implementation, will find something already tried and proven.

The team of developers I am part of is trying to develop a safe way to exchange sensitive data between a server and mobile devices.

We have come up with the following algorithm:

1. Device generates private RSA key, and sends the public key to server.

2. Server generates unique to user AES key and uses the RSA public key to encrypt it and send it back to device.

3. Device gets the AES key. Uses it to encrypt password and username and sends it to the server.

4. Server decrypts the username and password. If there is a match, the AES key is used for secure communication for X amount of time or until log-out. Else, the process must be restarted.

Is it safe enough? Are there ways it can be improved? What are the faults?

The team of developers I am part of is trying to develop a safe way to exchange sensitive data between a server and mobile devices.

We have come up with the following algorithm:

1. Device generates private RSA key, and sends the public key to server.

2. Server generates unique to user AES key and uses the RSA public key to encrypt it and send it back to device.

3. Device gets the AES key. Uses it to encrypt password and username and sends it to the server.

4. Server decrypts the username and password. If there is a match, the AES key is used for secure communication for X amount of time or until log-out. Else, the process must be restarted.

Is it safe enough? Are there ways it can be improved? What are the faults?

Edit: After reading the comments, what is a safer alternative and why?

The team of developers I am part of is trying to develop a safe way to exchange sensitive data between a server and mobile devices.

We have come up with the following algorithm:

1.Device generates private RSA key, and sends the public key to server.

2.Server generates unique to user AES key and uses the RSA public key to encrypt it and send it back to device.

3.Device gets the AES key. Uses it to encrypt password and username and sends it to the server.

4.Server decrypts the username and password. If there is a match, the AES key is used for secure communication for X amount of time or until log-out. Else, the process must be restarted.

Is it safe enough? Are there ways it can be improved? What are the faults?

The team of developers I am part of is trying to develop a safe way to exchange sensitive data between a server and mobile devices.

We have come up with the following algorithm:

1. Device generates private RSA key, and sends the public key to server.

2. Server generates unique to user AES key and uses the RSA public key to encrypt it and send it back to device.

3. Device gets the AES key. Uses it to encrypt password and username and sends it to the server.

4. Server decrypts the username and password. If there is a match, the AES key is used for secure communication for X amount of time or until log-out. Else, the process must be restarted.

Is it safe enough? Are there ways it can be improved? What are the faults?