# DH key exchange with only one end authenticated

We know there is a man in the middle vulnerability with unauthenticated DH key establishment. And the way to negate that is to use authenticate the keys used. But what if I only verify the signature of one end. Is there any vulnerability then?

EDIT: To be clear, I am not referring to the fact that the authenticated party does not know who its talking to. I am specifically thinking about a cryptographic vulnerability where someone who does not have control over the machine (of the unauthenticated end) can do some damage.

-
If the unauthenticated end's group element does not go into the signature then explicit authentication certainly fails and there could conceivably be an attack based on what DH value the server gets after the adversary has submitted a different group element. $\:$ If the group and generator are not known a-priori and they do not go into the signature then there could conceivably be an attack based on creating a detectable correlation between the DH values. $\;\;\;\;$ –  Ricky Demer May 10 at 21:03
What kind of an attack though? Does attacker get to do a successful man in the middle? Remember the client is verifying the server's keys. The server is not. So can an attacker really insert himself into the middle? –  user220201 May 12 at 1:47
"If the unauthenticated end's group element does not go into the signature then" there is a replay attack against explicit authentication. $\:$ A "... submitted a different group element" attack would either be man in the middle or not need that position. $\:$ An attacker probably can't "really insert himself into the middle", since DH in a generic group wouldn't allow him to do so, which makes it even less likely that there's an attack that doesn't require being a man in the middle. $\;\;\;\;$ –  Ricky Demer May 12 at 2:08
My previous two sentences also apply to "group and generator are not known a-priori" attacks. $\hspace{.65 in}$ –  Ricky Demer May 12 at 2:12