Let's say that we have a cryptosystem where Forward Secrecy and Man-In-The-Middle attacks are not an issue, purely hypothetically.
Would it be correct for a key exchange with any given public-key algorithm to simply work as follows?
- Alice calculates public & private key
- Alice sends the public key to Bob (and Eve intercepts it)
- Bob encrypts a random session key with the public key
- Bob sends the encrypted session key back to Alice (and Eve intercepts it)
- Alice decrypts the session key using the private key, Eve cannot decrypt in any reasonable amount of time
And all future communications would be encrypted with the session key. Are there any glaring vulnerabilities in this, besides forward secrecy and man in the middle attacks?