1) What is the use of Cert B in this protocol?

2) What does it prove to Alice?

3) Is it okay if we remove Cert B in this protocol? Even without Cert B, isn't the fact that Bob used his private key to decrypt the Key AB already proved his identity to Alice?

  • 1
    As to (3) I am guessing Alice does not know what Bobs public key is at the start. She reads it from Cert B that Bob sends her.
    – Anders
    May 29, 2016 at 11:29

2 Answers 2


I sneakily edit a sneaky MITM attacker into your image:

main in the middle attack

The problem with this protocol is that Bob does not authenticate with Alice. That means a man-in-the-middle attacker who can manipulate the data-flow between Alice and Bob can intercept the initial connection attempt from Alice and respond with their own certificate.

Alice will then communicate securely with Eavesdropper, thinking she communicates with Bob.

Eavesdropper can then simultaneously build a secure connection with Bob while claiming to be Alice.

Now both Alice and Bob believe they are communicating with each other, while they are actually communicating with Eavesdropper. That means Eavesdropper can look at all their communication in cleartext and even manipulate it.


Either Alice needs to authenticate to Bob or Bob needs to authenticate to Alice. But how can they do that before a secure connection is established? Either by exchanging their certificates beforehand or by having their certificates signed by a trustworthy 3rd party (a certificate authority).


Anyone can respond to Alice. I can say I'm bob, and then we will communicate securely, Alice will send me important information, and she will believe that I'm bob.

To prevent it, bob responds both certificate given to him by a trusted CA, proving he really is bob.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .