I understand that at least the following takes place:
- Asymmetric keys are used to exchange a symmetric key.
- Symmetric keys are used for exchange of chat messages.
From reading this question, it seems that it's not possible to establish such a communication with no prior shared information. With that being the case, it seems that the user id (which is quite long) is the only piece of information shared between clients before establishing communication through the interim untrusted server. I assume this is used in some way to prove the identity.
My question, therefore, is how are symmetric keys exchanged in such a way that the interim server can't perform a MITM attack (by presenting itself to Client A as Client B, and by presenting itself to Client B as Client A)?
If my question has been asked before, please feel free to flag it as a duplicate.