On new account creation in client-server "zero knowledge encryption" schemes
Client requests a nonce by sending new username Server sends client a random nonce if username is available. Client generates new RSA key pair. Client signs nonce with private key. Client sends singed nonce AND public key AND clear text username. Server verifies nonce using public key.
Does this preclude man in the middle attacks?
On the face of it the sever must trust everything send by the 'client' but only the originating client could have signed the nonce with it's own private key. So therefor the public key sent by the client can also be trusted?
Is this true?