Consider two types of attackers on a key exchange (KE) protocol and subsequent communication between the parties which used this KE instance to establish a secure communication key. Attacker Eve eavesdrops on their links, both over the internet and over telephone, while attacker Mallory can stage a man-in-the-middle attack over the internet and he can eavesdrop on the telephone but he cannot fake Alice’s and Bob’s voices over the telephone. In each case say whether the scheme is secure or not against each attacker type and briefly justify your answer.
(b) What if Alice uses CPA-secure public key encryption scheme to generate a (private,public) key pair, communicates her public key to Bob over email, and Bob chooses a random key k for the authenticated encryption scheme and emails it encrypted under Alice’s public key to Alice?
(d) Suppose Alice and Bob do as in (b) but they hash and read off over the telephone Bob’s chosen key k instead of Alice’s public key? Assume the hash function H' is a true random function, and in particular that for a random 128-bit key k the authenticated encryption using k remains secure even if the adversary learns the H'(k) value.
This is a homework question. I'm not really asking for the answer. It's just that I don't understand how Alice and Bob can retrieve the key k and the attacker can't since all of them see/hear the same H'(k). Suppose we don't have the attacker in this case. How do the honest parties exchange the key? I would really appreciate any explanation.