Securely start a client server connection without ssl/tls
if you want to use a password, SRP is probably a good choice.
alternatively, you could use ECDHE with ECDSA or RSA keys.
you should also use a MAC of some sort if you're using CBC (and encrypt then MAC). GCM or OCB would be much better choices.