I need to implement secure pairing between two devices based on a short shared PIN code with no trusted third party. If you think about the way bluetooth devices pair you won't be far off -- my device displays a code, I tell you, "the code is 40YA," you type it in on your device and we've got a secure connection.
The protocol should protect against MITM and eavesdropping attacks, and the PIN needs to stay valid and secure for at least a few hours. In other words, if an offline attack on the PIN is possible it should require at least a few hours to complete.
Does such a protocol exist? Bonus points if a reasonably bright non-cryptographer can understand it. :)
Update: Is Diffie-Hellman key exchange what I'm looking for?