I need to securely request and receive data from a server. The client has the RSA public key, and the server has the RSA private key. So I am generating a random key for AES-128/CBC cipher and encrypting my data using this cipher. The key is encrypted using RSA Public key and decrypted at server end, so both the client and server can communicate for the session.

Now, I have requirement where I need to do this in an offline fashion. The encrypted request will be sent to the server administrator and he will generate the encrypted response.The symmetric key should not be stored in Disk, for later usage. How should the server administrator share the symmetric key with client?

Perhaps, creating one more key pair, in which case the client will have the *private key* (other than a public key which it already has) and server will have a *public key*.

But is that secure?