diff --git a/dependencies/tlibc b/dependencies/tlibc
index 14ffede..0184d2e 160000
--- a/dependencies/tlibc
+++ b/dependencies/tlibc
@@ -1 +1 @@
-Subproject commit 14ffede476b786d9e31006f4bac52289ff656158
+Subproject commit 0184d2e8c96d882b815eae05fa160a40e9f7faf2
diff --git a/src/client/ServerConnection.c b/src/client/ServerConnection.c
index 0691aa2..4043635 100644
--- a/src/client/ServerConnection.c
+++ b/src/client/ServerConnection.c
@@ -3,9 +3,9 @@
 void ServerConnection_close(ServerConnection* conn){
     if(conn == NULL)
         return;
-    socket_close(conn->system_socket);
-    socket_close(conn->content_socket);
     RSA_destroyPublicKey(&conn->server_pk);
+    socket_close(conn->system_socket.sock);
+    socket_close(conn->content_socket.sock);
     free(conn->session_key.data);
     free(conn);
 }
@@ -60,16 +60,28 @@ Result(ServerConnection*) ServerConnection_open(ClientCredential* client_credent
     br_hmac_drbg_generate(&key_rng, conn->session_key.data, conn->session_key.size);
 
     printf("connecting to server %s\n", server_link_cstr);
-    try(conn->system_socket, i, socket_open_TCP());
-    try_void(socket_connect(conn->system_socket, conn->server_end));
+    try(Socket initial_socket, i, socket_open_TCP());
+    try_void(socket_connect(initial_socket, conn->server_end));
+    //TODO: add log
+    EncryptorRSA_construct(&conn->rsa_enc, &conn->server_pk);
+    // ClientHandshake client_handshake;
+    // Array(u8) encrypted_buf = Array_alloc_size(EncryptorAES_calcDstSize(sizeof(client_handshake)));
+    // u32 encrypted_size = 0;
+    // EncryptorRSA_encrypt(&conn->rsa_enc, struct_castTo_Array(&client_handshake), encrypted_buf, &encrypted_size);
 
-    // send session key to server
+    // send handshake and session key to server
     // request server info
     // show server info
     // save server info to user's db
     // request log in
     // if not registered, request registration and then log in
 
+    EncryptedSocket_construct(&conn->system_socket, initial_socket, conn->session_key);
+    
+    try(Socket _s, i, socket_open_TCP());
+    //try_void(socket_connect(_s, conn->server_end????));
+    EncryptedSocket_construct(&conn->content_socket, _s, conn->session_key);
+
     success = true;
     Return RESULT_VALUE(p, conn);
 }
diff --git a/src/client/client.h b/src/client/client.h
index fb4211a..fa4eeee 100644
--- a/src/client/client.h
+++ b/src/client/client.h
@@ -1,6 +1,6 @@
 #pragma once
-#include "network/socket.h"
 #include "cryptography/cryptography.h"
+#include "network/EncryptedSocket.h"
 
 Result(void) client_run();
 
@@ -16,13 +16,11 @@ void ClientCredential_free(ClientCredential* cred);
 
 typedef struct ServerConnection {
     EndpointIPv4 server_end;
-    Socket system_socket;
-    Socket content_socket;
     br_rsa_public_key server_pk;
     EncryptorRSA rsa_enc;
     Array(u8) session_key;
-    EncryptorAES session_aes_enc;
-    DecryptorAES session_aes_dec;
+    EncryptedSocket system_socket;
+    EncryptedSocket content_socket;
 } ServerConnection;
 
 Result(ServerConnection*) ServerConnection_open(ClientCredential* client_credential, cstr server_link_cstr);
diff --git a/src/network/EncryptedSocket.c b/src/network/EncryptedSocket.c
new file mode 100644
index 0000000..0baa93a
--- /dev/null
+++ b/src/network/EncryptedSocket.c
@@ -0,0 +1,49 @@
+#include "EncryptedSocket.h"
+
+void EncryptedSocket_construct(EncryptedSocket* ptr, Socket sock, Array(u8) aes_key)
+{
+    ptr->sock = sock;
+    EncryptorAES_construct(&ptr->enc, aes_key);
+    DecryptorAES_construct(&ptr->dec, aes_key);
+}
+
+
+Result(void) EncryptedSocket_send(EncryptedSocket* ptr,
+    Array(u8) decrypted_buf, Array(u8) encrypted_buf)
+{
+    Deferral(4);
+    EncryptorAES_encrypt(&ptr->enc, decrypted_buf, encrypted_buf);
+    try_void(socket_send(ptr->sock, encrypted_buf));
+    Return RESULT_VOID;
+}
+
+Result(void) EncryptedSocket_sendto(EncryptedSocket* ptr,
+    Array(u8) decrypted_buf, Array(u8) encrypted_buf,
+    EndpointIPv4 remote_end)
+{
+    Deferral(4);
+    EncryptorAES_encrypt(&ptr->enc, decrypted_buf, encrypted_buf);
+    try_void(socket_sendto(ptr->sock, encrypted_buf, remote_end));
+    Return RESULT_VOID;
+}
+
+Result(i32) EncryptedSocket_recv(EncryptedSocket* ptr,
+    Array(u8) encrypted_buf, Array(u8) decrypted_buf)
+{
+    Deferral(4);
+    try(i32 r, i, socket_recv(ptr->sock, encrypted_buf));
+    encrypted_buf.size = r;
+    DecryptorAES_decrypt(&ptr->dec, encrypted_buf, decrypted_buf, (u32*)&r);
+    Return RESULT_VALUE(i, r);
+}
+
+Result(i32) EncryptedSocket_recvfrom(EncryptedSocket* ptr,
+    Array(u8) encrypted_buf, Array(u8) decrypted_buf,
+    NULLABLE(EndpointIPv4*) remote_end)
+{
+    Deferral(4);
+    try(i32 r, i, socket_recvfrom(ptr->sock, encrypted_buf, remote_end));
+    encrypted_buf.size = r;
+    DecryptorAES_decrypt(&ptr->dec, encrypted_buf, decrypted_buf, (u32*)&r);
+    Return RESULT_VALUE(i, r);
+}
diff --git a/src/network/EncryptedSocket.h b/src/network/EncryptedSocket.h
new file mode 100644
index 0000000..e687302
--- /dev/null
+++ b/src/network/EncryptedSocket.h
@@ -0,0 +1,25 @@
+#pragma once
+#include "network/socket.h"
+#include "cryptography/cryptography.h"
+
+typedef struct EncryptedSocket {
+    Socket sock;
+    EncryptorAES enc;
+    DecryptorAES dec;
+} EncryptedSocket;
+
+void EncryptedSocket_construct(EncryptedSocket* ptr, Socket sock, Array(u8) aes_key);
+
+Result(void) EncryptedSocket_send(EncryptedSocket* ptr,
+    Array(u8) decrypted_buf, Array(u8) encrypted_buf);
+
+Result(void) EncryptedSocket_sendto(EncryptedSocket* ptr,
+    Array(u8) decrypted_buf, Array(u8) encrypted_buf,
+    EndpointIPv4 remote_end);
+
+Result(i32) EncryptedSocket_recv(EncryptedSocket* ptr,
+    Array(u8) encrypted_buf, Array(u8) decrypted_buf);
+
+Result(i32) EncryptedSocket_recvfrom(EncryptedSocket* ptr,
+    Array(u8) encrypted_buf, Array(u8) decrypted_buf,
+    NULLABLE(EndpointIPv4*) remote_end);
diff --git a/src/server/ClientConnection.c b/src/server/ClientConnection.c
new file mode 100644
index 0000000..64bab43
--- /dev/null
+++ b/src/server/ClientConnection.c
@@ -0,0 +1,10 @@
+#include "server.h"
+
+void ClientConnection_close(ClientConnection* conn){
+    if(conn == NULL)
+        return;
+    socket_close(conn->system_socket.sock);
+    socket_close(conn->content_socket.sock);
+    free(conn->session_key.data);
+    free(conn);
+}
diff --git a/src/server/server.c b/src/server/server.c
index 6e2ee9f..31b2e77 100644
--- a/src/server/server.c
+++ b/src/server/server.c
@@ -2,13 +2,13 @@
 #include "db/idb.h"
 #include <pthread.h>
 
-typedef struct AcceptedConnection {
-    Socket sock;
-    EndpointIPv4 client_end;
-} AcceptedConnection;
-
 static void* handle_connection(void* _args);
 
+typedef struct ConnectionHandlerArgs {
+    Socket accepted_socket;
+    EndpointIPv4 client_end;
+} ConnectionHandlerArgs;
+
 Result(void) server_run(cstr server_endpoint_str){
     Deferral(32);
     EndpointIPv4 server_end;
@@ -19,8 +19,8 @@ Result(void) server_run(cstr server_endpoint_str){
     try_void(socket_listen(main_socket, 512));
 
     while(true){
-        AcceptedConnection* args = malloc(sizeof(AcceptedConnection));
-        try(args->sock, i, socket_accept(main_socket, &args->client_end));
+        ConnectionHandlerArgs* args = (ConnectionHandlerArgs*)malloc(sizeof(ConnectionHandlerArgs));
+        try(args->accepted_socket, i, socket_accept(main_socket, &args->client_end));
         pthread_t conn_thread = {0};
         try_stderrcode(pthread_create(&conn_thread, NULL, handle_connection, args));
     }
@@ -30,8 +30,11 @@ Result(void) server_run(cstr server_endpoint_str){
 
 static void* handle_connection(void* _args){
     Deferral(64);
-    AcceptedConnection* conn = (AcceptedConnection*)_args;
-    Defer(free(conn));
+    ConnectionHandlerArgs* args = (ConnectionHandlerArgs*)_args;
+    // TODO: receive handshake and session key
+    
+    //ClientConnection conn;
+    
 
     Return NULL;
 }
diff --git a/src/server/server.h b/src/server/server.h
index 2428a33..b24aa05 100644
--- a/src/server/server.h
+++ b/src/server/server.h
@@ -1,5 +1,12 @@
 #pragma once
-#include "network/socket.h"
 #include "cryptography/cryptography.h"
+#include "network/EncryptedSocket.h"
 
 Result(void) server_run(cstr server_endpoint_str);
+
+typedef struct ClientConnection {
+    EndpointIPv4 client_end;
+    Array(u8) session_key;
+    EncryptedSocket system_socket;
+    EncryptedSocket content_socket;
+} ClientConnection;