I'm writing my own tiny software license system and I'd like to establish a secure channel with a hybrid cryptosystem (asymmetric -> symmetric).
I'd like to avoid bringing the entire certificate thing up since my application (executable shipped to customers) would include my public key entirely. The problem is: how to verify the server's identity?
I thought of the following: I could have the server send the timestamp when the connection was first attempted encrypted with his private key (so the client app would be able to verify the server is really who claims it is).. but the timestamp could be imprecise due to unpredictable TCP/IP delays.
What could the server send that isn't vulnerable to a replay attack from a third malicious party?