I need to build a project for uni where I need to transfer data securely from a client to a server. I can't use PKI structures and can't save pre-shared secrets (Imagine travelling to china and some bad guys check your pc). The only secret is the client's password, which got salted, hashed and saved into the database of the server.
So I thought about this: Generate the hash on the client pc. Generate a key from this (using pdkf2) on the pc as well on the server. This key is now the symmetric key. The client encrypts a specific, non secret phrase and sends to the server, who decrypts it and checks if its the "expected" phrase. If yes, the client is now authenticated. This happens a second time, just the other way around. So now both know the other one is not faked. Then, the client can encrypt the data, send it to the server who can decrypt the data.
Is this really secure? How can I be sure that after inital "handshake", they are still the same? If this is a bad idea, how would you solve this problem?
Please note, that I'm really new to this. Thank you