Let's assume an insecure channel.

Is it safe to exchange Alice & Bob public keys first then apply them to sign communications during the DH process? (then encrypt+sign all future communications)?

Should the process be rather: a DH process applied first, then the public key exchange with unsigned messages, then encrypt+sign all future communications? (where obviously at the next DH, there will be not need to exchange again the public keys.)

1 Answer 1


For that first use you're doing unauthenticated DH.

And this is only safe against passive eavesdroppers. It is NOT safe against an active Man-in-the-Middle (MITM).

So if you were MITM'd during that first exchange, then all bets are off. If that time-window of exploitation is small enough for your purposes, you may still want to use it.

(So what you're doing is known as Trust-On-First-Use (TOFU). The first key exchange is validated in some way or other, or not at all, and all subsequent communication then uses that key.)

More info on Wiki: https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange

Especially this:

Although Diffie–Hellman key agreement itself is an anonymous (non-authenticated) key-agreement protocol, it provides the basis for a variety of authenticated protocols [...]

  • So in case there is no CA that validates the public key signatures, there is therefore no solution to prevent a MITM while trying to exchange these public keys to thereafter establish an authenticated DH... Feb 25, 2015 at 12:26
  • I guess that with a TOFU, whether we exchange the public keys over DH or in clear does not matter then... correct? Feb 25, 2015 at 12:32
  • Right. Both are unauthenticated. There could be zero, one or more Mallories (MITMs) between your Alice and Bob and you'd have no way to tell. Feb 25, 2015 at 15:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.