Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
We all know how DH is great, and ECDH is much greater, but only in case of Eve spying on public keys, so how can ECDH defeat the ablity of "Eve" to change the public keys between Bob and Alice with her own public keys?
and vice versa. What is the solution to this problem in the…Castle Aggh?
Traditionally Eve does not meddle with what she sees on the wire she's eavesdropping. That task is reserved for Mallory, the MITM, or malarkey-in-the-middle.
From a protocol perspective, it makes no difference to Mallory whether Alice and Bob are using finite-field DH (‘DH’) and elliptic-curve DH (‘ECDH’). What matters is whether Alice and Bob use authentication.
For example, does Alice know Bob's public signing key? If so, Bob can sign the entire DH key agreement transcript on the network when it has completed. While Mallory could replace Alice or Bob's DH key on the wire, they cannot forge Bob's signature on what Bob thinks the network transcript ought to have been.
So if Mallory does replace anything but leaves Bob's signature intact, Alice will notice that the transcript was meddled with when she tries to verify Bob's signature. If Mallory also tries to replace Bob's signature, Alice will notice that it's not a valid signature because Mallory can't forge signatures by Bob.
(This is not a full description of an authenticated DH protocol—just the basic concepts that go into it. The full gory details of real protocols like TLS and Signal are a little more than will fit in the margins of this layman's summary.)
