I'm working on an embedded project that needs to communicate with a server. Both the server and the device have an AES key pre-installed.
I have a network device that provides http services but not https. My proposal is to AES encrypt the data in the body of the post command.
Given that I have the IP of the server, the AES key is unique to this device and I rotate IV's with each session (the sessions here are very short), what could be the downside as opposed to adding https on the embedded device?
I'm new to http and restful services. Is there a standard http header or use of S/MIME for this?