I'd like to know if this communication technique is secure enough against attacks, both on the connection itself and the password-storing procedures.
Both the client and the server have access to 2 pre-shared static keys:
Enc Key A (32-byte string)
Enc Key B (32-byte string)
The server has access to a static key:
DB Enc Key
Then I proceed as follows:
Client connects to a server (regular TCP connection)
Server generates a crypto-safe ECDH key pair (public and private keys), using SynCrypto Library (https://github.com/synopse/mORMot/blob/master/SynCrypto.pas)
Server encrypts (AES-256 bit with Internal Salt) the public key using "Enc Key A" as the secret and sends it to the client
Client generates its own key-pair, then also encrypts its public key using the "Enc Key A" as the secret and sends it to the server
Both client and server generate a shared secret (SynCrypto) and hash the [Enc Key B+shared secret] 1000 times (HMAC SHA-256) using "Enc Key A" as the secret
r = Shared_Secret; repeat(1000) r = hmac_sha256(Enc_Key_A,Enc_Key_B+r);
All further communication between server and client will be encrypted (AES-256 bit with Internal Salt) using the hash as the secret
As for the password storage, for each user (once for each user, not once for every connection) I generate a unique key, which is then used to hash the password 1000 times:
r = Password; repeat(1000) r = hmac_sha256(DB_Enc_Key,UniqueKey+r);
Then both the UniqueKey and the "r" (hashed password) are stored in a plain text file
I'm using GML (GameMaker Language) for both the server and client and using a Pascal .dll for the cryptographic functions.
Is that secure enough?
Is it vulnerable to attacks?
How can I improve its security?