We all know how DH is great, and ECDH is much greater, but only in case of Eve spying on public keys, so how can ECDH defeat the ablity of "Eve" to change the public keys between Bob and Alice with her own public keys?

  1. Alice generate keys and send her public key to Bob
  2. Eve intercept Alice's public key and send her own key
  3. Bob get Eve's public key and think it is Alice public key

and vice versa. What is the solution to this problem in the…Castle Aggh?


Traditionally Eve does not meddle with what she sees on the wire she's eavesdropping. That task is reserved for Mallory, the MITM, or malarkey-in-the-middle.

From a protocol perspective, it makes no difference to Mallory whether Alice and Bob are using finite-field DH (‘DH’) and elliptic-curve DH (‘ECDH’). What matters is whether Alice and Bob use authentication.

For example, does Alice know Bob's public signing key? If so, Bob can sign the entire DH key agreement transcript on the network when it has completed. While Mallory could replace Alice or Bob's DH key on the wire, they cannot forge Bob's signature on what Bob thinks the network transcript ought to have been.

So if Mallory does replace anything but leaves Bob's signature intact, Alice will notice that the transcript was meddled with when she tries to verify Bob's signature. If Mallory also tries to replace Bob's signature, Alice will notice that it's not a valid signature because Mallory can't forge signatures by Bob.

(This is not a full description of an authenticated DH protocol—just the basic concepts that go into it. The full gory details of real protocols like TLS and Signal are a little more than will fit in the margins of this layman's summary.)

  • $\begingroup$ Sadly it appears that these days, Mallory is dying out, in favor for Eve to be the one-size-fits-all attacker :( $\endgroup$ – SEJPM Feb 15 '18 at 9:50
  • $\begingroup$ the description is more than enough , thank you , but what if they meet first time and there is no signatures known for both? $\endgroup$ – Dr.Jack Millan Feb 17 '18 at 6:56
  • $\begingroup$ @Dr.JackMillan: Within TLS Alice has certificates signed by a trusted certificate authority (CA) for authentication, which requires Alice just to trust this CA to issue certificates with the subject of Bob only for Bob. Within SSH Alice can verify the key fingerprint of Bob, but of course she needs to somehow get the fingerprint up-front in a secure way. If Alice and Bob don't have any kind of shared trust or knowledge they could try Trust on first use - but if Mallory is already meddling with the initial connection they have lost. $\endgroup$ – Steffen Ullrich Feb 17 '18 at 8:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.