Is this session start protocol secure? I am working on a password manager application that saves the user's passwords in a remote server. I need to use AES in CTR mode to encrypt the passwords before sending them to the server. The client is supposed to login/identify himself with a master password (which is already set in the server). This is what I've thought of until now:


Client connects to server.
Server sends a random value RAND1.
Client generates a random value RAND2, and calculates hmacKey = SHA1 (master|RAND1|RAND2).
Client calculates HMAC of RAND2, appends it to RAND2 and sends it to the server.
The server (who knows the master password) calculates its own hmacKey and verifies the client.


This hmac key would be used during this whole session. Is this secure?
You have the classic problem of establishing a common secret key between the two parties before they begin exchanging any sensitive information. Consider Diffie-Hellman or - since you're dealing with a client/server setup and the risk of a MitM - a private key on the server side and then use public key encryption to establish the session key before communicating the password. This can be achieved with RSA, authenticated DH, ElGamal, and a few other methods.