Assume that the server and the client both has some secret key K. Is it possible to have a key exchange protocol with authentication between them such that MITM attack cannot hold and if the key is exposed at some point in time the past sessions are still in secret?
I tried it using the regular Diffie-Hellman key-exchange protocol with passing a signature of K to the server, but in every version of it a MITM can impersonate the client and te server and watch all the session...
Yes, it can be done. This is called a Password Authenticated Key Exchange. Such protocols reuse "asymmetric crypto" elements (such as Diffie-Hellman) and mix them "smartly" with a shared secret, so that:
The third condition implies that a low-entropy shared secret, e.g. a "password", can still safely be used, hence the name for this kind of protocol. The cryptographic concept was invented in 1992 by Bellovin and Merrit, under the name "encrypted key exchange" (formally, a DH key exchange in which messages are symmetrically encrypted with the shared secret, so that decryption with the wrong secret still yields syntaxically valid DH messages -- the actual mathematical requirements are subtle).
In the context of SSL/TLS, a standard PAKE protocol has been defined, under the name SRP (see also the Wikipedia page). SRP is good. Unfortunately, Web browsers don't seem to support it (yet).
