diff --git a/src/main/java/com/threerings/presents/client/BlockingCommunicator.java b/src/main/java/com/threerings/presents/client/BlockingCommunicator.java
index fc65d340d..f3fb1fda1 100644
--- a/src/main/java/com/threerings/presents/client/BlockingCommunicator.java
+++ b/src/main/java/com/threerings/presents/client/BlockingCommunicator.java
@@ -51,6 +51,7 @@ import com.threerings.io.UnreliableObjectOutputStream;
 import com.threerings.presents.net.AESAuthRequest;
 import com.threerings.presents.net.AuthResponse;
 import com.threerings.presents.net.AuthResponseData;
+import com.threerings.presents.net.AuthRequest;
 import com.threerings.presents.net.DownstreamMessage;
 import com.threerings.presents.net.LogoffRequest;
 import com.threerings.presents.net.PingRequest;
@@ -630,10 +631,12 @@ public class BlockingCommunicator extends Communicator
                     response = (AuthResponse)receiveMessage();
                     // If we've received a secure response, proceed with authentication
                     if (response instanceof SecureResponse) {
-                        sendMessage(AESAuthRequest.createAuthRequest(
+                        AuthRequest areq = AESAuthRequest.createAuthRequest(
                                     _client.getCredentials(), _client.getVersion(),
                                     _client.getBootGroups(), _client.requireSecureAuth(),
-                                    pkcreds, (SecureResponse)response));
+                                    pkcreds, (SecureResponse)response);
+                        sendMessage(areq);
+                        _client.setSecret(areq.getSecret());
 
                         // now wait for the auth response
                         log.debug("Waiting for auth response.");
diff --git a/src/main/java/com/threerings/presents/client/Client.java b/src/main/java/com/threerings/presents/client/Client.java
index f4b4969ff..63ed549b5 100644
--- a/src/main/java/com/threerings/presents/client/Client.java
+++ b/src/main/java/com/threerings/presents/client/Client.java
@@ -254,6 +254,22 @@ public class Client
         return _requireSecureAuth;
     }
 
+    /**
+     * Sets the secret key to use with a session.
+     */
+    public void setSecret (byte[] secret)
+    {
+        _secret = secret;
+    }
+
+    /**
+     * Gets the secret key to use with a session.
+     */
+    public byte[] getSecret ()
+    {
+        return _secret;
+    }
+
     /**
      * Returns the version string configured for this client.
      */
@@ -1045,6 +1061,9 @@ public class Client
     /** Our public key. */
     protected PublicKey _publicKey;
 
+    /** Our session secret key. */
+    protected byte[] _secret;
+
     /** If we require a secure connection to send our credentials. */
     protected boolean _requireSecureAuth = false;
 
diff --git a/src/main/java/com/threerings/presents/net/AESAuthRequest.java b/src/main/java/com/threerings/presents/net/AESAuthRequest.java
index fe8104364..1bcc4efe7 100644
--- a/src/main/java/com/threerings/presents/net/AESAuthRequest.java
+++ b/src/main/java/com/threerings/presents/net/AESAuthRequest.java
@@ -87,6 +87,12 @@ public class AESAuthRequest extends AuthRequest
         return _clearCreds;
     }
 
+    @Override // documentation inherited
+    public byte[] getSecret ()
+    {
+        return _key;
+    }
+
     @Override // documentation inherited
     public String toString ()
     {
diff --git a/src/main/java/com/threerings/presents/net/AuthRequest.java b/src/main/java/com/threerings/presents/net/AuthRequest.java
index 7ed488cee..78491e512 100644
--- a/src/main/java/com/threerings/presents/net/AuthRequest.java
+++ b/src/main/java/com/threerings/presents/net/AuthRequest.java
@@ -83,6 +83,14 @@ public class AuthRequest extends UpstreamMessage
         return _bootGroups;
     }
 
+    /**
+     * Returns a shared secret key used for sending encrypted data to the client.
+     */
+    public byte[] getSecret ()
+    {
+        return null;
+    }
+
     @Override
     public String toString ()
     {
diff --git a/src/main/java/com/threerings/presents/server/ClientLocal.java b/src/main/java/com/threerings/presents/server/ClientLocal.java
index 138b0c13e..703b56682 100644
--- a/src/main/java/com/threerings/presents/server/ClientLocal.java
+++ b/src/main/java/com/threerings/presents/server/ClientLocal.java
@@ -34,5 +34,6 @@ import com.threerings.presents.data.ClientObject;
  */
 public class ClientLocal extends SimpleStreamableObject
 {
-    // nothing to track at this level
+    /** A shared secret key used for encrypting data. */
+    public byte[] secret;
 }
diff --git a/src/main/java/com/threerings/presents/server/ClientManager.java b/src/main/java/com/threerings/presents/server/ClientManager.java
index a8669151f..9a04fcda9 100644
--- a/src/main/java/com/threerings/presents/server/ClientManager.java
+++ b/src/main/java/com/threerings/presents/server/ClientManager.java
@@ -390,6 +390,12 @@ public class ClientManager
         // immediately
         clobj.release();
 
+        // Grab the shared secret from the session and stick it into the client local
+        PresentsSession session = getClient(username);
+        if (session != null) {
+            clobj.getLocal(ClientLocal.class).secret = session.getSecret();
+        }
+
         // stuff the object into the mapping table
         _objmap.put(username, clobj);
 
diff --git a/src/main/java/com/threerings/presents/server/PresentsSession.java b/src/main/java/com/threerings/presents/server/PresentsSession.java
index 1c3f4401d..5ae64f832 100644
--- a/src/main/java/com/threerings/presents/server/PresentsSession.java
+++ b/src/main/java/com/threerings/presents/server/PresentsSession.java
@@ -126,6 +126,14 @@ public class PresentsSession
         return _areq.getTimeZone();
     }
 
+    /**
+     * Returns the shared secret for this session.
+     */
+    public byte[] getSecret ()
+    {
+        return _areq.getSecret();
+    }
+
     /**
      * Returns true if this session has been disconnected for sufficiently long that it should be
      * forcibly ended.
@@ -1197,6 +1205,7 @@ public class PresentsSession
     protected AuthRequest _areq;
     protected Object _authdata;
     protected Name _authname;
+    protected byte[] _secret;
     protected PresentsConnection _conn;
     protected ClientObject _clobj;
     protected IntMap<ClientProxy> _subscrips = IntMaps.newHashIntMap();