I'm creating a mobile fast-paced game and currenly I'm working on login/registration/connecting. I'm trying to make it right so it won't mess in the future.
For now, I have read multiple articles of which method should I use to make a 'secure user session' between client and a server.
My goal is to use RSA only to exchange AES
key and send packets with AES
only
It should look like that:
Store the same public RSA key on all clients
Store one private RSA key on the server
Client sends the 'AES initialization data
' to the server encrypted with public RSA
. Server decrypts AES
data with a private RSA
key, stores AES
data, encrypts AES
data with AES
data and sends back to the client.
Client receives AES
data encrypted with the same AES
data, decrypts and if everyhing is ok, handshake is done, we can securely send messages using AES
data.
I'm using Java and I have RSA
algorithm done, I checked packets with Wireshark, encrypted and decrypted and it works. The thing I can't finish is AES encryption cause I'm missing some knowledge.
I know that AES
uses IV parameter
which is used like a 'salt' in SHA
.
Basically I know how IV works, I read some, but I have no idea when and how many times should I send it.
Should IV
be generated again and again with each packet or I should just generate one with a SecretAESKey
, save it and use this pair to encrypt data and decrypt it?
I really learn quick so please don't judge me cause this question may look stupid to you.
Thanks for any help!