Answers · The network and the web

How does a man-in-the-middle attack still work if the key exchange is secure?

In shortA key exchange proves only that you share a secret with whoever answered. An attacker on the path answers you themselves and opens a second exchange to the real server, so both halves look secure.

A key exchange guarantees that you and whoever is at the other end of the wire end up holding a secret no listener can compute. It says nothing at all about whether that whoever is the party you had in mind. An attacker sitting on the path exploits precisely that: they answer your exchange in place of the server, then open their own separate exchange with the real server, and finish holding two keys instead of one. Nothing is broken, nothing is guessed, and both ends see a connection that is, from where they sit, entirely correct.

Two exchanges, not one broken one

Work it through with numbers small enough to check by hand. Take a prime $p = 23$ and a generator $g = 5$ , with each side's public value formed as $g$ raised to that side's private value, and the shared secret formed by raising the other side's public value to your own private value. Alice picks $a = 6$ and Bob picks $b = 15$ . At real sizes this is the step nobody can undo; at these sizes every step is visible.

\begin{aligned} A &= g^{a} = 5^{6} = 15625 \equiv 8 \pmod{23} \\ B &= g^{b} = 5^{15} \equiv 19 \pmod{23} \\ B^{a} &= 19^{6} \equiv 2 \pmod{23}, \qquad A^{b} = 8^{15} \equiv 2 \pmod{23} \end{aligned}

A watcher on the wire sees 8 and 19 and cannot produce 2 from them without undoing the exponentiation, which at real sizes is the whole point. The guarantee is delivered in full. Now put Mallory in the path, with a private value $m = 7$ and public value $M = 5^{7} \equiv 17 \pmod{23}$ . Mallory answers Alice with 17 as though it were Bob's value, and separately sends 17 to Bob while opening a connection of her own. Two complete exchanges run, each one arithmetically flawless.

\begin{aligned} \text{Alice computes } M^{a} &= 17^{6} \equiv 12 \pmod{23} \\ \text{Mallory computes } A^{m} &= 8^{7} \equiv 12 \pmod{23} \\ \text{Bob computes } M^{b} &= 17^{15} \equiv 15 \pmod{23} \\ \text{Mallory computes } B^{m} &= 19^{7} \equiv 15 \pmod{23} \end{aligned}

Alice and Bob do not share a secret. Alice shares 12 with Mallory, Bob shares 15 with Mallory, and both numbers are perfectly good secrets that no listener on the wire can derive. Mallory holds both, and can compute either from a value she was legitimately sent. The fact that 12 and 15 differ is the entire fingerprint of the attack, and it is visible only to somebody standing outside both connections at once.

FIG 1

party	sends	receives	secret held	believes it is speaking to
Alice	8	17	12	Bob
Mallory	17 to Alice, 17 to Bob	8 and 19	12 and 15	both of them
Bob	19	17	15	Alice

Every integrity tag verifies, because each sender computed it with the key the receiver actually holds. There is no failing check to display and no anomaly to raise. The padlock is not lying. There is a genuine, strong, correctly authenticated channel between Alice and Mallory, and another genuine one between Mallory and Bob. What the padlock never said is who sits at the far end of it, so both ends report success while every message passes through a machine that reads it in plain text before re-encrypting it onward. Reading is the lesser half: the attacker can also alter a field, recompute the tag with the key the receiver expects, and the alteration arrives looking untouched.

The requirement is position rather than skill, which puts the attack within reach of a longer and duller list of parties than people expect. Anyone operating the network you are on: a cafe, a hotel, an airport, an employer, a university. Anyone who has compromised a router anywhere along the path. A resolver that answers the lookup with the attacker's address, which places them at the destination without touching the path at all. And routinely, an inspection appliance an organisation installs on its own network, which is this attack run with one side's consent. Measurements of intercepted connections tend to find that most of it is installed deliberately, by the user's own security software or by their employer, for reasons those parties consider good. The mechanism does not change: each is a machine holding two keys and reading everything, and each is a new place for the traffic to leak from.

Why expecting an error is the wrong expectation

The natural guess is that a man in the middle must trip something: a key that fails to match, a signature that does not verify, a warning the browser would show. Nothing in the exchange compares the received public value against any expectation, because nothing so far has told either side what to expect. The value 17 is only wrong to Alice if she already knows what the correct value should be, and she does not. Her arithmetic is checked against the value she received, not against the identity she wanted, and by that standard everything is consistent. So the attacker is not defeating the key exchange. They are using it correctly, twice. This is also why stronger mathematics changes nothing: a longer key, a bigger prime, a better curve each make both halves of the attack stronger and leave the count of connections at two. The gap cannot be closed from inside the conversation, because everything inside the conversation is equally available to the attacker.

What changes it is something known before the conversation begins. If Alice already holds Bob's public key from some other source, then 17 is not a value she has to accept: she compares it, finds it is not the key she knows, and aborts. The same holds if a certificate binds Bob's name to a key and is vouched for by somebody Alice already trusts. Either way the check rests on an object that arrives from outside the exchange, and it is a different kind of thing from any number in the handshake. Two options fail to scale: knowing a shared secret suits an application with its own accounts, and knowing every server's key suits nobody. The arrangement actually used is the third, where a trusted party vouches for the server key, which swaps the problem of knowing every server for the problem of choosing who to trust. Drop that anchor and the attack returns in full, unaltered, with every cipher still working perfectly.

Worth keeping

Key agreement establishes a shared secret with whoever answered and says nothing about who answered.
An attacker in the path can run two complete and valid connections, hold both keys, and leave neither end with anything to report.
The check that stops it has to come from outside the conversation, because everything inside the conversation is equally available to the attacker.

Where this goes next

This question is one step of How a Message Stays Private, a course that works through its subject from the beginning. The page that teaches this part of it is Who You Are Talking To, and it reads the whole way through whether or not you have an account.

What an account changes is the practice: problems standing under every idea, marked with a reason rather than a tick, in a copy of the course that is yours.

Read that page The whole course

How does a man-in-the-middle attack still work if the key exchange is secure?

Two exchanges, not one broken one

Why expecting an error is the wrong expectation

Worth keeping

Where this goes next

Read alongside