How is STS more secure than regular DH

Question

I'm trying to understand the STS protocol (using the wikipedia page as source), but I don't see how this protocol is any more secure than DH regarding man in the middle attacks.

If Alice and Bob don't know each others public keys, and have no secure channels at all, then an attacker (Charlie) could forge asymetric keys (x',x'G) and (y',y'G), and make independant connections between Alice and Bob for each of the 8 steps of the basic STS protocol as described on the wikipedia page. Alice would believe Bob's key is y'G, and vice versa. Charlie would be able to decrypt each of the signatures using the two different shared secrets (xy'G and x'yG), and then sign (y'G,xG) with xy'G and sign (yG,x'G) with x'yG and encrypt them again. So the encryption and signing of the (yG,xG) pair doesn't seem to make any difference to me.

If Alice and Bob have a secure channel allowing them to exchange their public keys then I don't see a way for a MITM attack even with regular DH.

Can someone help me identify where I'm wrong ?

Answer 1

Note the first paragraph of the page:

In public-key cryptography, the Station-to-Station (STS) protocol is a cryptographic key agreement scheme. The protocol is based on classic Diffie–Hellman, and provides mutual key and entity authentication. Unlike the classic Diffie–Hellman, which is not secure against a man-in-the-middle attack, this protocol assumes that the parties have signature keys, which are used to sign messages, thereby providing security against man-in-the-middle attacks.

It's worth mentioning that this is to be expected --- the notion of "identity" in cryptography is different than in real life, and is probably best thought of as "knows the private key corresponding to some public key". Given this, users must have a way to share public keys free from adversarial behavior (otherwise an attack like you describe can easily go through). This is the purpose of Certificate Authorities in the modern web, and while they're a cryptographically inelegant solution (they're explicitly a trusted third party, where much of cryptography can be phrased as removing trusted third parties), removing them seems difficult.

Note that this protocol explicitly mentions authentication, while DH doesn't. This is what enables you to MiTM DH. Of course, in practice people use a separate digital signature scheme with DH key exchange for authentication --- so what's the difference?

Something that should become fairly clear rather early in cryptography is that how you combine primitives matters. ECB mode can use secure primitives but still be insecure. Just like that, DH can use a secure signature scheme and still be insecure. This was the basis of the Logjam attack in 2015, where you could MiTM TLS 1.2 via (among other things) taking advantage of poor use of signing in the DH key exchange.