title: Encryption in java - best practices?
body: <p>I am working on a client-server application in Java which is going to use <strong>private-key encryption</strong>.</p>
  
  <p>Currently I have a class with a static object of the <code>Cipher</code> class which I initialise like this: <code>myCipher.init(Cipher.DECRYPT_MODE, secretKey, ivParameterSpec);</code>.</p>
  
  <p>Now my question is: I have two-way communication, should I have a separate <code>Cipher</code> object for each way (one for encrypting and one for decrypting) and use the same initialisation vector? Or should I just use the same object and call <code>Cipher.init()</code> to change the modes depending on whether I am encrypting or decrypting?</p>
  
  <p>It makes sense to have separate objects in my head, but I just wanted to be sure. I tried googling but most examples only show encryption one way.</p>
  
  <p>Currently I send the initialisation vector to the server unencrypted, is this correct, or is there a security flaw?</p>
  
  <p>Or am I approaching it completely the wrong way?</p>
  
  <p>Thanks.</p>