The Man-in-the-Middle Attack

Diffie-Hellman has a weakness that isn’t mathematical. It’s far more troubling, and you absolutely must be aware of it.

The scenario

Eve is no longer content just to eavesdrop: she intercepts and substitutes.

Alice            Eve             Bob
  --- A --->
              --- E --->
              <--- B ---
  <--- E' ---
  s1 = (Alice-Eve)         s2 = (Eve-Bob)

Alice thinks she’s talking to Bob but is actually negotiating with Eve. Bob thinks he’s talking to Alice but is also negotiating with Eve. Eve holds two secrets: s1 with Alice, and s2 with Bob.

She decrypts each message using one of them, reads it, modifies it if necessary, re-encrypts it using the other, and forwards it. Both parties see a perfectly seamless conversation.

The cause

The protocol guarantees that the secret is shared with the person at the other end. It says nothing about who that person is.

This is a problem of authentication, not confidentiality. Diffie-Hellman does exactly what it promises; it simply does not promise identity.

The solution

The exchange must be linked to a verifiable identity. In practice:

• a signature: Bob signs his value B with his private key, and Alice verifies the public key using a certificate. This is what TLS does;
• a pre-shared secret, however short, mixed into the exchange;
• an out-of-channel comparison: encrypted messaging services display a hash that both parties compare either verbally or when they meet in person.

A general lesson

Bear this in mind, as it goes far beyond Diffie-Hellman: encryption without authentication offers no protection whatsoever. A perfectly encrypted channel to the wrong party remains a channel to the wrong party. Confidentiality without identity verification offers, above all, the illusion of security.