Note: I am a network researcher, but a security newbie. Hence, this post may contain wrong understanding of security including DH and RSA. If it does, please let me know it.
I've designed a certain network protocol extension, which generates shared secret keys between two terminals, Alice and Bob. To this end, I first used a simple ECDH. (Elliptic curve parameters are negotiated wirelessly via other messages, but the messages are omitted in the following figure.)
However, I didn't consider malicious attacker, Mallory. To prevent MITM and let the both verifies that the message 3 and 4 come from the valid counterpart, not from Mallory, I adopted RSA public key signing and verification.
- Message 1 is periodically broadcasted so that anyone can capture this.
- Message 2 is sent if Alice wants to share a secret key with Bob.
verify(data, pub)are RSA signing and verification.
- The resultant shared secret will be used to generate another shared secret (which is used in the existing protocol) and will be discarded immediately.
Is this a correct implementation of DH over RSA wirelessly? Or are there something that I am missing?