Exchange of initial key for two way encrypted communication

Question

Hello all,
I think the following question has to do with my lack of knowledge of cryptography and will be happy for any pointers you might provide.
I am trying to encrypt socket communication between client/server. I have decided to use AES from the SUNJCE. I don't want to store a static key on the client as that would pose a threat(decompilation). And I don't want to send the key to the client as that would defeat the whole purpose of encryting the communication (the key might get sniffed over the network).
I have a feeling there is a better way but since I am new to crytpography I am a bit lost. Can anybody tell me if there is a standard (best-practice) way of doing this.
Thanks in advance for your help.
depeupleur_

Answer 1

For anyone interested in AES for flash check this code
out:
http://www.codecta.com.br/rijndael.zip
Wow - that is impressive.
I now have a different problem, i can protect the data
being transmitted between server and a legitimate
client but since the connection is done through
internet and i don't know who the potential users are
how can i make sure the client that connects in the
first place is not a rogue client looking to replace a
proper client and trying to determine the
communication protocols and encryption mechanisms?You really do need to read up on how this stuff works. If "Applied Crypto" is too much, there's another book, "Practical Cryptography", by Ferguson and Schneier, that covers the topic pretty readably as well. (The first section, anyway - it gets pretty dense after that...)
In general - if you're going to worry about the identity of the client, you can set up your server to require client-side certificates. Explaining how certificates work is more than a forum-message thing.
Note that, in The Land of Crypto, you must assume that The Bad Guy knows everything about your communications protocols except for the key. If your security relies on hiding them, or your specific encryption algorithm, then you're pretty much toast.
Too right, i won't even pretend that i could write any
crypto code. (unless it is for my little son to
decrypt as a game)It's actually a very interesting field. I would not call myself a cryptographer by any stretch of the imagination - I'm just an educated user of crypto libraries. With a little research, you can be one too! ;)
Good luck,
Grant