My model is one where I have several clients which wish to speak with some (but not all) of the other clients.
All messages will be sent through a server.
Only the two clients communicating with each other should be able to know the message. So the server AND the other clients should not be able to work out what message was sent.
Communication between two clients may start and end several times a day.
Messages will be plaintext with potentially unlimited length, but likely to be much less, think SMS style messages.
Given these circumstances, how should I encrypt the messages? I don't mind writing extra code if it leads to better speed or efficiency.
I know the rough basics of how RSA and AES work but I can't figure out what is best.
When you generate a public/private key pair for RSA, is there any situation where you would need to generate a new pair? Or can one client have one public key and give the same key to anyone that wants to talk to him and only him be able to (ever) read the messages, but they store the public key for all future messages?
Or should I have a separate symmetric AES key for pair of clients and simply share that when contact is first initiated and use that forever. Again, is there any circumstance where this would need to be generated again?
How would I store the key(s) so they persist if client crashes/shutsdown/reboots?