I'm creating a mobile fast-paced game and currenly I'm working on login/registration/connecting. I'm trying to make it right so it won't mess in the future.
For now, I have read multiple articles of which method should I use to make a 'secure user session' between client and a server.
My goal is to use RSA only to exchange
AES key and send packets with
It should look like that:
Store the same public RSA key on all clients
Store one private RSA key on the server
Client sends the '
AES initialization data' to the server encrypted with public
RSA. Server decrypts
AES data with a private
RSA key, stores
AES data, encrypts
AES data with
AES data and sends back to the client.
AES data encrypted with the same
AES data, decrypts and if everyhing is ok, handshake is done, we can securely send messages using
I'm using Java and I have
RSA algorithm done, I checked packets with Wireshark, encrypted and decrypted and it works. The thing I can't finish is AES encryption cause I'm missing some knowledge.
I know that
IV parameter which is used like a 'salt' in
Basically I know how IV works, I read some, but I have no idea when and how many times should I send it.
IV be generated again and again with each packet or I should just generate one with a
SecretAESKey, save it and use this pair to encrypt data and decrypt it?
I really learn quick so please don't judge me cause this question may look stupid to you.
Thanks for any help!