I've written a C# Library that I hope will be used for security purposes in a commercial application. The application will communicate through the internet and not on an internal network. I am using RSA for Asymmetric Encryption and Rijndael for Symmetric Encryption. Currently the process I am using is as follows:
- The Client sends it's RSA Public Key to the server.
- The Server encrypts the Rijndael Symmetric Key using the Public Key and sends the result to the client.
- The client decrypts the Symmetric Key and stores it.
- When either party sends any data, a new IV is generated each time, but the Symmetric Key remains the same.
I expect the lifespan of the connection between the Client and Server to last for at most 10 - 20 exchanges of information before the connection closes, thus being 10 - 20 sets of data encrypted with the same key, but with a different IV. Past this, the Symmetric Key is destroyed. Both Asymmetric Keys, the Symmetric Key and IV are all generated by the classes I'm using.
Is what I am doing safe? Are there any major security flaws I'm missing?
EDIT: I send the IV along with the Rijndael Encrypted data, where it is seperated from the data and then used by the receiving party to decrypt the data. I have read elsewhere that this is safe practice?