Tag Info

New answers tagged


The use of the AES key many times is not a problem. However, there is a fundamental flaw with your solution. The server has no way of validating that it received the client's authentic public key. In particular, a man-in-the-middle can capture the client's public key, can forward its own public key to the server, and can then decrypt all traffic sent by each ...


Why not use the mature, analysed, and successful pattern of PGP communications? First each party exchange the public keys of both the Client and Server. Even better out of band verify them depending on your threat model (i.e. phone call or some other independent method of verification of each side's identity and public key fingerprints) which prevents ...

Top 50 recent answers are included