I'm already doing classic DH with pre-shared key in my setup, and it prevents people knowing the same password from eavesdropping on others' traffic. But it doesn't cover situations where a third party authenticates to the server, then masquerades as the server to an incoming client, performing an authentication and then forwarding the traffic to and from the server transparently to both parties, all the while it is able to read and modify it at will.
Wikipedia contains half an explanation in its DH article about how the authenticated/public key flavor goes, but it's confusing to follow step by step. From what I managed to understand, the private key is g^a%p=PUBKEY then for each one-way encrypted message, g^b=ENCRYPTED_SECRET is computed, and sent to the PUBKEY holder.
I do not understand however, what the PUBKEY holder is supposed to do with ENCRYPTED_SECRET upon receipt in order to retrieve b, if b is indeed what is supposed to even be retrieved. Nor what the formula for this should be, what I exponentiate to what etc.
A step by step would help. Thank you.