Ensure Data Integrity In An ECDH Key Excange

Question

Been playing around with the inner workings of onion routing and I have a problem. If I wanted to send the 2nd node of a relay network an ephemeral ECC public key, it has to go through node 1, so that node 2 does not know the IP of the client. Once the shared secret is calculated, an encrypted connection from the client to node 2 that essentially proxies through node 1 can be created, so node 1 can't view the info that passes through it from the client to node 2. However, how can node 2 be sure that the ephemeral ECC key it receives from the client via node 1 is the actual key. How can the integrity be verified, to counter MITM attacks?

I dont think that signing the key with a permanent ECC key would work because then the 2nd node would have to use the clients permanent ECC public key to verify the data, and then node 2 would know what the clients IP is, as it would have to be stored together, so that the correct key can be used to verify the signature.

How can the integrity of the key exchange be verifies without using digital signatures?

Answer 1

1. Authentication

then node 2 would know what the clients IP is

This statement is not necessarily true. If a certificate is given to a web site, then yes, IP or domain name will be known. But if your client is a person, then certificate can create some email address that can be without any meaning to the world.

2. Pre-shared secret

Use a pre-shared secret. For instance, you can use it for HMAC.

If the client has neither a certificate that you trust nor pre-shared secret, you cannot be sure whom are you communicating with: with your client or with a man in the middle.

Update

Key exchange is one of the most important and most complex questions in cryptography. There is no trivial solution.

A) Use secure channel for key exchange. You can exchange key via direct contact with the other party (not realistic), or somebody whom you trust carries the key from you to the other party, or you have a secure physical channel, etc. Here an asymmetric algo can be preferred, because the public key and thus the channel does not need to be confidential.

B) Use some chain of trust. If you trust to some CA (like Google) and trust its sub-CAs, then you can trust that the public key of the other party really belongs to it. If you trust... You know that Google Chrome distrusted certificates issued by Symantec & Co (Thawte, VeriSign, GeoTrust, ...). You heard about DigiNotar and Trustwave. E.g. Trustwave intentionally issued multiple certificates that enabled MITM. On the other side the number of correctly created certificates is estimated of about 99.995%. Besides certificate issuing there are other important aspects like trustworthiness of DNS.

Some may mention quantum approach. But it is actually requires on these two.

As you see, there is no easy solution.