Let's assume an insecure channel.

Is it safe to exchange Alice & Bob public keys first then apply them to sign communications during the DH process? (then encrypt+sign all future communications)?

Should the process be rather: a DH process applied first, then the public key exchange with unsigned messages, then encrypt+sign all future communications? (where obviously at the next DH, there will be not need to exchange again the public keys.)

1 Answer 1


For that first use you're doing unauthenticated DH.

And this is only safe against passive eavesdroppers. It is NOT safe against an active Man-in-the-Middle (MITM).

So if you were MITM'd during that first exchange, then all bets are off. If that time-window of exploitation is small enough for your purposes, you may still want to use it.

(So what you're doing is known as Trust-On-First-Use (TOFU). The first key exchange is validated in some way or other, or not at all, and all subsequent communication then uses that key.)

More info on Wiki: https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange

Especially this:

Although Diffie–Hellman key agreement itself is an anonymous (non-authenticated) key-agreement protocol, it provides the basis for a variety of authenticated protocols [...]

  • So in case there is no CA that validates the public key signatures, there is therefore no solution to prevent a MITM while trying to exchange these public keys to thereafter establish an authenticated DH... Commented Feb 25, 2015 at 12:26
  • I guess that with a TOFU, whether we exchange the public keys over DH or in clear does not matter then... correct? Commented Feb 25, 2015 at 12:32
  • Right. Both are unauthenticated. There could be zero, one or more Mallories (MITMs) between your Alice and Bob and you'd have no way to tell. Commented Feb 25, 2015 at 15:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .