I'm new to cryptography and I just started learning about the Diffie-Hellman key agreement. I read that this system is vulnerable to a man-in-the-middle attack when used alone. What kind of attack is this?

  • $\begingroup$ A --> M --> B, M is a MITM between A and B. $\endgroup$
    – SEJPM
    Jul 2, 2015 at 21:01
  • 1
    $\begingroup$ I just quickly edited your question. Feel free to roll-back (by clicking on the "edited" with my name below) if you don't like the edits. $\endgroup$
    – SEJPM
    Jul 2, 2015 at 21:05

1 Answer 1


in diffie-hellman key exchange algorithm vulnerability's is good defined by RSA lab :

"The Diffie-Hellman key exchange is vulnerable to a man-in-the-middle attack. In this attack, an opponent Carol intercepts Alice's public value and sends her own public value to Bob. When Bob transmits his public value, Carol substitutes it with her own and sends it to Alice. Carol and Alice thus agree on one shared key and Carol and Bob agree on another shared key. After this exchange, Carol simply decrypts any messages sent out by Alice or Bob, and then reads and possibly modifies them before re-encrypting with the appropriate key and transmitting them to the other party. This vulnerability is present because Diffie-Hellman key exchange does not authenticate the participants. Possible solutions include the use of digital signatures and other protocol variants."

and some simple example of mitm attack :

Alice "Hi Bob, it's Alice. Give me your key." → Mallory Bob

Alice Mallory "Hi Bob, it's Alice. Give me your key." → Bob

Alice Mallory ← [Bob's key] Bob

Alice ← [Mallory's key] Mallory Bob

Alice "Meet me at the bus stop!" [encrypted with Mallory's key] → Mallory Bob

Alice Mallory "Meet me in the windowless van on 22nd Ave!" [encrypted with Bob's key] → Bob


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.