I'm new to cybersecurity and am writing a TCP server with the Java Socket API. There is a client and server class. The server class is what would be run on a server, it listens on a specified port and accepts socket connections. If the client part of the program attempts to connect, it must send the correct encrypted password to the server. The server has a list of correct passwords, hashed with SHA-256.
I have an RSA public-private key system set up, where the server keeps the private and sends the public key to the client. The client hashes the raw password with SHA-256 then uses the public key to encrypt it before sending it across the socket.
What I am worried about (and I'm sure there are other issues) is that an attacker will use the public key to try a bunch of passwords with the server. If I generate AES symmetric keys using some special string hardcoded into the client and server side, would it make sense to encrypt the public key itself with the symmetric key before sending that over the wire, and using those keys for additional communication?
I am not concerned about anything other than the password that is sent from client to server right after the socket is accepted.