Imagine Alice connecting to Bob over an untrusted network. An attacker silently intercepts their messages, presents the attacker’s public key to Alice as Bob’s, and presents another key to Bob as Alice’s. Each party may believe the attacker is the other party. section 1.4.1 section 9.1
A man-in-the-middle attack is an active attack on communication: the adversary intercepts, alters, reorders, or relays messages while impersonating both endpoints. Passive recording alone is different; without an active substitution during setup, later decryption may be impossible. section 10.2 section 9.1
An unauthenticated Diffie–Hellman exchange creates the opening:
- Alice sends a public key, but accepts any received key as Bob’s. section 1.4.1
- The attacker replaces Alice’s and Bob’s public keys, establishing separate shared secrets with each endpoint. section 1.4.1
- The attacker can then relay or modify traffic between the two protected connections while remaining hidden. section 9.1
The core remedy is authentication: participants must obtain or verify the other party’s public key through a trusted mechanism. Public-key cryptography simplifies trust establishment but does not eliminate the need for a root of trust. section 1.4.1 section 10.2
Practical defenses include:
- Use an authenticated key exchange or a trusted certificate-based system rather than accepting arbitrary public keys. section 1.4.1 section 10.2
- For device pairing, compare fingerprints or a short authenticated string (SAS) through an out-of-band channel. section 11.3.3
- Treat short SAS values carefully: commitment before disclosure prevents an attacker from choosing keys adaptively to force matching values. section 11.3.3
Phone-to-car pairing
A phone and car can display the same short authenticated string for the negotiated connection. Matching values help the user detect that the key exchange was not intercepted, although the cited Bluetooth warning advises caution about relying on its security protocols.
