There is a key exchange process which I am having a look at. I am aware of key exchange algorithms such as Diffie-Hellman and the like, however as there is a method to provide an initial key out-of-band (in this case with the installer of the agent) this was proposed as an alternative. Ignoring any potential comments about the actual use of this (i.e. assume we can't use some kind of web of trust solution and just using TLS etc is not feasible), as there are other steps and constrains not relevant to the security of this specific process - can anyone see any flaws in this specific process?
'Agent' is installed, the current RSA Public Key of the 'Central Server' is bundled into the Agents installer
Upon starting - the agent will generate an RSA Keypair and will encrypt its public key using the Central Server's public key.
The agent will then send this to the Central Server which will decrypt it using its Private Key
The Central Server will then generate a random symmetric key (say AES key for arguments sake) and will encrypt this newly generated symmetric key with the Agents RSA Public Key
The Central Server will then send this encrypted Symmetric Key back over to the Agent, which can decrypt it with its own RSA Private Key
The two hosts now have a symmetric key to encrypt further communication between them with. I was worried about a potential MITM attempt of step 1 where an attacker can replace the Agents public key with their own, however if they don't have access to the servers public key then they can't do this as it will fail to decrypt right? Am I missing anything?