j

The protocol depicted in Figure 10.8 is insecure against a man-in-the-middle attack. Suppose Alice and Bob wish to exchange keys, and Darth is the adversary. The attack proceeds as follows: Darth prepares for the attack by generating two random private keys X D 1 and X D 2 and then computing the corresponding public keys Y D 1 and Y D 2 . 1 . Alice transmits Y A to Bob. 2 . Darth intercepts Y A and transmits Y D 1 to Bob. Darth also calculates K 2 = ( Y A ) X D 2

mod  q . 3 .

Bob receives Y D 1 and calculates K 1 = ( Y D 1 ) X E mod q . 4 . Bob transmits X A to Alice. 5 . Darth intercepts X A and transmits Y D2 to Alice. Darth calculates K 1 = ( Y B ) X D 1

mod  q . 6 .

Alice receives Y D2 and calculates K 2 = ( Y D2 ) X A mod q . 7 . At this point, Bob and Alice think that they share a secret key, but instead Bob and Darth share secret key K 1 and Alice and Darth share secret key K 2. All future communication between Bob and Alice is compromised in the following way: Alice sends an encrypted message M : E( K 2, M ). 1 . Darth intercepts the encrypted message and decrypts it, to recover M . 2 . Darth sends Bob E( K 1, M ) or E( K 1, M '), where M ' is any message. In the first case, Darth simply wants to eavesdrop on the 3 .