The simple scenario is two devices on one WiFi network sitting side by side. The user can copy a short code from one device to the other to be the "password" however this code can't be too long. Let's assume it's at most 12 decimal digits. The devices will only allow one attempt so any MITM attacker will have to take a chance with only 1 in a trillion for success, which will also alert the user that he (the attacker) is there, so that would be secure "enough" for me. This is all there is, that is, there is no server which both devices have its public keys.
But how would this work? I thought of something like the following but ran into a problem. If there's a standard solution for this key-exchange scenario, please feel free to ignore the following:
I thought device d1 can create a random number in the above mentioned range and use it as the key for Rijndael encryption of its public encryption key but without a need for padding so that all ciphertexts can be "decrypted" so that the MITM won't be able to brute force which is correct by being alerted that a wrong one is wrong. The second device d2 then uses that password to decrypt the ciphertext (which is transmitted over wifi). It then uses it to encrypt and send d1 its (d2's) keys. The idea is that the MITM won't know which of the trillion possible deciphered texts is correct. And even when he (the MITM) sees the message back from d2, won't be able to brute force it, because the plaintext of the sent ciphertext will be random-like (because it's a public key of an unknown key pair) and will be encrypted like the first one, where there is no padding and therefore an attacker can't see whether they got the correct plaintext or an error.
Unfortunately this might not work because the MITM might be able to preemptively craft a set of keys (- a trillion decipherings of some key) where the key used can be detected from the ciphertext, and send that key to d2 and then discover the "password" from d2's response. Can this be done?
Also, the usual rule of not rolling out my own encryption scheme.
So, is there a safe way to exchange keys despite a MITM, using some short known password? (Preferably with forward secrecy such that brute forcing, if it takes a month, won't give the attacker the ability to start impersonating one of the devices from then on.)