I understand how RSA works (generate private/public key pair, send public key to whoever you want to talk to, encrypt with public, decrypt with private), but isn't there a flaw in this?
Let's say A wants to send a message to B. A generates his public/private key pair, and sends the public key over a network to B, right? What's stopping C coming along and intercepting this public key, generating his own public key, and then sending his own public key to B? Then, when B sends his public key back to A, C could intercept this, store it, and send his own public key to A.
Now, when A sends an encrypted message using what he thinks is B's public key (but is actually C's), C will intercept this message, decrypt it, then encrypt it again using B's actual public key.
Would this work? If not, why not? Is it just a matter of using a secure network to send the public key?