Note: I am a network researcher, but a security newbie. Hence, this post may contain wrong understanding of security including DH and RSA. If it does, please let me know it.

I've designed a certain network protocol extension, which generates shared secret keys between two terminals, Alice and Bob. To this end, I first used a simple ECDH. (Elliptic curve parameters are negotiated wirelessly via other messages, but the messages are omitted in the following figure.)

enter image description here

However, I didn't consider malicious attacker, Mallory. To prevent MITM and let the both verifies that the message 3 and 4 come from the valid counterpart, not from Mallory, I adopted RSA public key signing and verification.

enter image description here


  • Message 1 is periodically broadcasted so that anyone can capture this.
  • Message 2 is sent if Alice wants to share a secret key with Bob.
  • sign(data, priv) and verify(data, pub) are RSA signing and verification.
  • The resultant shared secret will be used to generate another shared secret (which is used in the existing protocol) and will be discarded immediately.

Is this a correct implementation of DH over RSA wirelessly? Or are there something that I am missing?

  • The second protocol still looks like the attacker will be able to MITM the protocol by sending his own keys at the RSA-Key exchange phase. – VincBreaker Jun 5 '17 at 7:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.