# Diffie-Hellman man-in-the-middle attack

Diffie-Hellman Key Exchange Basic Protocol:

Let G be a cyclic group of order $$n$$ and generator $$g$$.

Alice chooses $$a \in \{0,\ldots,n-1\}$$ and Bob chooses $$b \in \{0,\ldots,n-1\}$$.

Alice computes $$h_A = g^a$$ and Bob computes $$h_B = g^b$$.

Alice sends $$h_A$$ to Bob and Bob sends $$h_B$$ to Alice.

Alice computes $$(h_B)^a = g^{ab}$$ and Bob computes $$(h_A)^b = g^{ab}$$.

The common symmetric key is $$g^{ab}$$

As we all know, this basic protocol is vulnerable to the man-in-the-middle attack.

Therefore I propose the following variant, where Alice and Bob use a digital signature scheme, both having a pair of public and private keys for signing (the public portion of this keypair is shared beforehand):

Let G be a cyclic group of order $$n$$ and generator $$g$$.

Alice chooses $$a \in \{0,\ldots,n-1\}$$ and Bob chooses $$b \in \{0,\ldots,n-1\}$$.

Alice computes $$h_A = g^a$$ and Bob computes $$h_B = g^b$$.

Alice sends $$(h_A,sig_{sk_A}(h_A))$$ to Bob and Bob sends $$(h_B,sig_{sk_B}(h_B))$$ to Alice.

Alice verifies the signature. If ok, proceed to next step. Otherwise abort. The same for Bob.

Alice computes $$(h_B)^a = g^{ab}$$ and Bob computes $$(h_A)^b = g^{ab}$$.

The common symmetric key is $$g^{ab}$$

This variants differs from the Station-to-Station Protocol, which provides security against man-in-the-middle attacks.

Is my variant of the basic protocol also secure against man-in-the-middle attacks? What is the advantage of the STS Protocol when compared to this variant?

• Hint: what happens if Eve passively captures $(h_A,\text{sig}_{\text{sk}_A}(h_A))$, and replays that to Bob on a later day, or to Carol just after that? Is there an equivalent in STS?
• I don't know... If that happens, Eve still does not learn the value of $a$, so she cannot learn the common key May 3 '20 at 19:11