Can you use MITM to hijack a public key meant for key based signing?

Question

After reading "Verify the identity of sender" , which was part of an answer on StackOverflow, I was wondering if the following is possible:

Based on part II, if I am sitting between Alice and Bob:

• Can I not wait for Alice to send her public key to Bob.
• I block this key and discard it, and send my own public key instead.
• Bob then thinks this public key is from Alice.
• I send any message I want now, signed with my own private key.
• Bob 'verifies' these messages with my public key, and thinks all of these messages are from Alice.

Is this scenario possible?

Answer 1

Yes, this is a standard MITM attack. This is why we typically use some sort of out-of-band method for verifying public keys. For example, in OpenPGP, we can use key signatures from trusted parties or in-person verification, and in TLS, we use certificate authorities. For SSH host keys, we can verify a fingerprint on a trusted website or using DNSSEC. There are even more ways of doing the same thing: you can download someone's SSH keys from GitHub and there are sites like Keybase which tie multiple accounts to a set of credentials cryptographically, in addition to other various techniques.

Ultimately, in order to trust the integrity of the messages, you have to verify the public key somehow independently.