How Diffie-Hellman authentication works? [duplicate]

Question

There are a lot of good videos on a simple Diffie-Hellman in the internet but unfortunately that is susceptible to the MITM attack. I understand how with DH the two parties are able to calculate a shared secret (shared private key?)

So now i am trying to understand the authenticated version, which should be safe from the MITM attack. Unfortunately i have not found a simple explanation to how it should work.

1. As I understand it requires the use of some certificates (pre existing keys?). Having some pre existing keys does not make a lot of sense to me, since the whole purpose of DH is key exchange.

2. And vice versa: If i can just generate a private and public key for both parties and transfer the public keys than why do i need DH at all?

3. Is an entirely secure method available to establish a connection between the two parties who don't have some preexisting knowledge of each other (by using authenticated DH)? If so then how does the authentication scheme work?

Answer 1

Diffie-Hellman comes in two basic forms - static and ephemeral - and a number of combinations of those.

• Ephemeral Diffie-Hellman means that both parties of a key agreement generate new - ephemeral - key pairs and send their respective ephemeral public key to the other party. If both parties generate ephemeral key pairs each time, you get Perfect Forward Secrecy. This type of key agreement is usually used in conjunction with signature algorithms (RSA, DSA, ECDSA) to authenticate the ephemeral public keys of one or both parties. When Ephemeral Diffie-Hellman is used plainly, without a supplemental signature algorithm, it is anonymous, unauthenticated and susceptible to MITM attacks.
• Static Diffie-Hellman means that both parties of a key agreement use long term - static - key pairs. This form of Diffie-Hellman becomes authenticated exactly when at least one party is able to link the other party to the static key that is used. Typically, this is done either by that party having advance knowledge of the Static Diffie-Hellman public key of the other party, or by both parties belonging to some form of Public Key Infrastructure, in which a trusted third party connects the identity of the peer to its public key.

Hence, regarding your questions:

1. The purpose of Diffie-Hellman is to agree on a shared secret. This is perfectly possible with long term static keys. The public keys will still have to be exchanged somehow, but it might be done ahead of time, through authenticated channels.
2. Static Diffie-Hellman public keys would typically be exchanged through a Public Key Infrastructure. Having two parties directly exchanging static public keys to use with Static Diffie-Hellman, would indeed not necessarily be better or more practical than them generating a shared secret directly, and storing that shared secret instead of the public key of the other party.
3. The purpose of authentication is typically to tie an online presence to some form of identity that makes some form of sense to the other party. Typically, you want a method of authentication that identifies the other party in the way that makes most sense given the circumstances. Theoretically, if the parties have no advance knowledge of each other, and will not assign any other identity to each other beyond the initial online presence, they could use the public keys from the initial anonymous key exchange for authentication. Normally, authentication would however be accomplished either by exchanging public keys in advance, or by means of a public key infrastructure.