I'm trying to do key exchange using the following scheme.
- Server generates an RSA-2048 key pair and sends the public part to the client
- Client generates an RSA-592 key pair (I have to use RSA-592 due to client performance reasons; 592 bits is the minimum key size for encrypting 256 bits using OAEP)
- Client encrypts the public part of the key pair using the public key from the server, and sends it to the server
- Server encrypts AES-256 key (random) using the client's RSA key pair, and sends it to the client
So, is this secure than plain RSA-592?