I'm trying to devise a good security scheme to protect comms over Wi-Fi.
Right now, I have 2 devices that already communicate via UPnP but I need to secure this communication. I've come up with this:
- Once the client sees the other host, picks a pair of Diffie-Hellman parameters (out of 1000 pregenerated pairs of $g$ and $p$) and enacts a DH key agreement with the host. This happens each time both devices want to initiate a session, and auth persistence is not needed (generated keys are discarded after the session finishes).
- Once both devices have calculated the same secret, this secret is hashed with SHA-256 to create a common key.
- When the client wants to send a message to the host, it encrypts it with AES-CBC-PKCS#7, using the key, it appends the generated IV and sends it to the host. The host's response follows the same method.
Whoever observes a session can only see $g$, $p$, $A$, $B$, the ciphertexts and their corresponding $IV$s.
Is this secure enough?
P.D.: I'm under the impression that trying to use TLS is way too much for such a simple need and it would be too complicated to get out in a reasonable timeframe.