AES Secure key generation and storage I have a client-server application, which is transferring data between its components in a secure way. I currently use AES algorithm with CBC mode to transfer data and file. This is the scenario: Client ask for data(file or plaintext), server takes the request and encrypt data with a iv/key pair and sends encrypted data to the client. Client always stores data encrypted. Client is a per user application. So for this reason, client should open the files, should read data even in offline mode. (Server application is .Net based, Client is Delphi)

What I need is a secret key generation mechanism, that is secure and changeable between client and server, something that is related to the current user ('user1', 'user2' etc). I'm not experienced in cryptography, So I will be waiting for the experienced one's advices.

Thanks in advance

Edit: I will try to explain my problem in more details. We have a client application, that is opening some files in some format (say 3dsmax). Those files are downloaded from  a database in server and only authenticated user can download this files. But even if authenticated user download this one, files shouldn't be copied to other computers, disks. because those files contain strictly worked models (say 3d models) and need to be encrypted; and there is another case that when client sqlite database need to be updated, we send scripts to the client  in an encrypted way and client decrypts and executes, saves values encrypted. 

We do all of this work. Perhaps I asked the question not in a proper way. By key generation I mean that, how do we create a mechanism to securely and consistently exchange the data? Preferably without key storage but some mechnaism that creates the key in runtime but in both sides by using userids, licence keys etc... we store user information both in client and server. I hope I could explain
In practice you should use the tools already provided.  SSL/TLS and by extension HTTPS are very powerful tools that provide proper implementations of key exchange, authentication and privacy.  As far as I can tell this solves all of your problems.

AES-CBC alone is problematic.  As Thomas pointed out you lack authentication.  A common solution to this problem is using an HMAC and here is a good discussion of HMACs and encryption.