Should I really salt in a RSA/AES hybrid connection?

Question

I start by saying that I'm pretty new to encryption and I'm pretty bad at finding weakness in everything.

Said so, i'd like to talk about an huge doubt I'd like to clarify before I end up doing something wrong in pratice: one thing I learnt while studying symmetric key encryption methods such as aes is that salts are god. You should salt, salt and salt. And I get that it's really useful to block rainbow dictionary attacks and that's good. However, from what I got, all the examples were talking about cases where you're encrypting an user's password, which are usually known words or similar.

Let's suppose now an advanced scenario: I have an hybrid communication system using a RSA (asymmetric) and aes (symmetric) hybrid communication system between clients and a server where:

-the server owns a RSA private key, the clients owns the public part

when a client wants to establish a connection, he does:

1-generate a random symmetric key

2-encrypt it with the public RSA key

3-send it to the server

4-the server reads the ciphred key with the private key

5-now both systems has a symmetric key which will of course be monouse, which had never been transmitted in plain, and can communicate with the speed of aes

So the question is: in a scenario like that, is that really worthy salt the aes symmetric key before sending it to the server in point 3? Because first it's random, second it's monouse, 3rd as far as I know there is no way an hacker could do much without knowing the private key. And anyway the final password being sent is something which will be anyway a random set of characters, just as the unsalted key.

Or is there a scenario where it could be useful?

Answer 1

You only need to hash and salt passwords that you store on a server for user authentication. In your case, you have a random key that will only be used for a connection's lifetime, so a salt would be useless.

Also keep in mind that your protocol doesn't provide authentication and is likely vulnerable to two dozens catastrophic attacks. We already have TLS for establishing a secure connection : use that if you want serious security (and don't make your own implementation : these require as much experience as the protocol itself).