I am reading some articles about Key Exchange. I know classic key exchange,such as Diffie-Hellman key Exchange. This type algorithm is vulnerable to man-in-the-middle attack. However, When using digital signature algorithm, this attack is invalidate. so Authenticated Key Exchange consist of classic key exchange and digital signature algorithm? who can tell me?
One way to understand this is through a rather abstract and constructive viewpoint, abstracting away specifics.
, a DH key exchange needs to be done in an authenticated manner otherwise man-in-the-middle attacks become possible. In other words, we needs the communication to happen on a authenticated channel.
How do we get an authenticated channel? One way is to use digital signatures. They would allow to verify that the message comes from the legitimate sender. However we still have a problem, the verification keys needs to be transmitted somehow and so far we only have an insecure channel.
In order to resolve this problem, we send digital signatures parameters over an authenticated channel that is obtained by using certificates. If we trust certification authorities, we have indeed an authenticated channel.
Everything put together in a constructive way:
1) Using certificates we construct an authenticated channel that allows exchange of digital signature parameters
2) Using digital signatures, we construct an authenticated channel that allows key-exchange(D.H).
3) Using key exchange results we could also construct a secure channel.
Yes, for example in SSL peers identify each other by exchanging certificate. - each peer verifies cerfiticate that received other peer. - If verificatioin is end successfully, client start diffie-hellman by send client's DH-parameter
that is example of authenticated key exchange