At the moment I'm designing a crytosystem for a VPN server. One of the requirements is Perfect Forward Secrecy, but I'n not sure how to implement authentication on the ephemeral key exchange.
If both parties possess a signed public key (signed by a CA or common trusted party) and exchange this, they can verify the identity of each other through the CA's public key. To implement perfect forward secrecy, both parties have to generate an ephemeral keypair and send each other the public key. Since these keys are not signed, how can one authenticate the other to guarantee that the keys were not altered/switched? Even if the keys are exchanged over an verified channel (for example using the signed and trusted public keys) that doesn't automatically ensure the ephemeral keys were generated by the same party. Also calculating a MAC over the public ephemeral key does not lead to a secure cryptoscheme since the public key could have been created by an man-in-the-middle in the first place. Is there any way the ephemeral key exchange can be authenticated?