Possible Duplicate:
Is there a way to negotiate a secret between 2 parties with no prior knowledge?

Imagine two clients who want to establish a secure connection over a server. Both clients have a trustworthy public key from the server, so they can establish a secure connection to the server. If the clients would now exchange public keys, the server could obviously do a man-in-the-middle-attack. Is there any way to prevent this? (So that, if the establishment of the connection succeeds, the clients are guaranteed to have a secure channel and the server cannot eavesdrop.)

| improve this question | | | | |
  • So the answer is pretty much: It's impossible, that is, there is no known method. (Without cheesy things like waiting a constant amount of time.) – cooky451 Dec 6 '12 at 0:37

Sounds like you could probably do a Diffie Hellman to create a temporary session key and use that to symmetrically-encrypt the communications.

| improve this answer | | | | |
  • Please include in your answer why the server is now prevented to do a man-in-the-middle-attack. :) – cooky451 Dec 5 '12 at 23:11

Not the answer you're looking for? Browse other questions tagged or ask your own question.