11 — Attack
Man-in-the-Middle (MITM)
Vanilla DH is anonymous. An active attacker can transparently relay and re-encrypt — neither side notices.
Theory
Because plain Diffie-Hellman has no authentication, Mallory sits between Alice and Bob, intercepts each public value, substitutes her own, and ends with two separate shared keys — one with each side. Both believe they share with each other; both share with Mallory.
# What Alice & Bob think happens:
K_ab = g^(ab) mod p # single shared key (illusion)
# What actually happens under MITM (m, m' = Mallory secrets):
K1 = (g^m')^a = g^(m'a) mod p # Alice–Mallory
K2 = (g^m)^b = g^(mb) mod p # Mallory–Bob
K1 ≠ K2 — Mallory decrypts with one, re-encrypts with the other.
Step-by-step attack
Alice sends
A = g^a. Mallory intercepts and replaces with M = g^m.Bob receives M, computes
K₂ = M^b = g^(mb) — shared with Mallory.Bob sends
B = g^b. Mallory intercepts, replaces with M' = g^m'.Alice receives M', computes
K₁ = (M')^a = g^(m'a) — shared with Mallory.Mallory holds both K₁ and K₂. Decrypts Alice→Bob with K₁, re-encrypts with K₂, forwards — and vice versa.
Nothing visibly breaks: messages arrive, ciphertexts decrypt. Total compromise.
Two separate keys; Mallory translates between them.
Defense — authenticate the exchange (STS pattern)
# Station-to-Station: sign the DH values with long-term keys
A → B: A = g^a, Sig_A(A, B_expected)
B → A: B = g^b, Sig_B(B, A), Enc_K(Sig_B) # encrypt sig under K
# Each side verifies the signature against a known public key / CA cert.
# Mallory can't forge Sig_A or Sig_B → substitution detected.
- TLS: server cert (CA-signed) authenticates handshake, then DH gives session key
- SIGMA / IKEv2: bind identity with MACs over the transcript
Key takeaway
Key agreement without authentication is key agreement with anyone — including the attacker.