Reusing encrypted message on MITM attack? I'm using RSA public key private key for sending AES key from each client to server application.
then i'm using this AES key and IV for communicating between client and server.
what should i do for this MITM attack scenario??
client[encrypted text]   ---&gt; Server
the MITM can use this encrypted text again to send it to server. consider if this encrypted text is an operation on transfering money.
the solutions i have planned for this are these:
1- attach new IV(encrypted) on each sending to server , so the server knows what's the next message iv is
well , i just can think about this only for now
You didn't mention the mode of encryption used.
If you are using CBC, predictable IVs maybe an issue.
I would recommend not reusing IV to prevent message replay. You can add a counter inside the encrypted payload and ensure it is increasing.
Notice when you add protection against replay you need to think about out of order etc.
In many cases protocols add timestamps and allow only a limited discrepancy.