Experimental voodoo nearly done

Just need to find out if server can decrypt client's challenge response
using AES! :o