Poor man's SSL - is this method as safe as SSL/TLS? I need to send data between two applications. I've got requirement that says that data should be transmitted using secure protocol such as SSL/TLS. Data is sent using TCP sockets and I don't have built in SSL/TLS support. However, I'm able to encrypt content using AES and I'm also able to exchange small amount of data using https. I'm thinking of exchanging the key for symmetric encryption using https and then encrypt the data with AES before sending it over the network.

I'm in full control of both parties that exchange information. The keys are exchanged using SSL and I know that both parties are able to use AES. I guess there is no way anyone could decrypt the data without knowing the key. I agree that someone would be able to interrupt the transmission but it will be only noise since he would have to know the key to encrypt data with it.

Is this solution safe? Can it be compared to using SSL/TLS in terms of security? Is there some obvious security hole that I'm missing? Do you see any flaws in terms of security of the message (by it I mean that someone who is unauthorized sends his data as part of transmission or reads data from my transmission)?
TLS not only provides privacy, but also authentication:


You can be sure you know who you speak to (at least the client knows if the server was using a certificate). (You provide this by the "HTTPS key exchange" you are doing at the start.)
You can be sure that you speak to the same entity at the other side throughout the whole live of your connection (even if you don't know who this is, e.g. as a server with non-authenticated client).
You can be sure that you get exactly what the other side sent, not something modified by someone between both sides.


AES (or any other block cipher) in a streaming mode (like CBC, CFB, OFB, CTR, ...) doesn't provide this guarantee. Because of this, there are various attacks at these modes which also endanger your privacy.

So make sure you are either


using a mode of operation which also includes authentication (look for "AEAD") or
using a normal privacy mode together with an external MAC (like HMAC) - and transfer the MAC key together with the encryption key during your key exchange).