Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

Possible Duplicate:
Is there a way to negotiate a secret between 2 parties with no prior knowledge?

Imagine two clients who want to establish a secure connection over a server. Both clients have a trustworthy public key from the server, so they can establish a secure connection to the server. If the clients would now exchange public keys, the server could obviously do a man-in-the-middle-attack. Is there any way to prevent this? (So that, if the establishment of the connection succeeds, the clients are guaranteed to have a secure channel and the server cannot eavesdrop.)

share|improve this question
So the answer is pretty much: It's impossible, that is, there is no known method. (Without cheesy things like waiting a constant amount of time.) – cooky451 Dec 6 '12 at 0:37

marked as duplicate by Jeff Ferland♦ Dec 5 '12 at 23:44

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1 Answer

up vote 0 down vote

Sounds like you could probably do a Diffie Hellman to create a temporary session key and use that to symmetrically-encrypt the communications.

share|improve this answer
Please include in your answer why the server is now prevented to do a man-in-the-middle-attack. :) – cooky451 Dec 5 '12 at 23:11

Not the answer you're looking for? Browse other questions tagged or ask your own question.