What is the problem with Diffie-Hellman key exchange?

The problem is the complexity.

Diffie-Hellman key exchange has to solve the following problem: Given a group G, two points P and Q in G and a base point P' that is not equal to P, compute a shared secret key k given a public key p and a private key q. In fact, Diffie-Hellman key exchange only solves the following problem: Diffie-Hellman key exchange can be described as the following procedure: 2. 3. Alice selects q = kP. 4. Alice publishes p, k, and q. 5. 6. Bob computes q' = kP'. 7. Bob calculates k' = r'q' mod n. 8. Bob computes s = r' mod n. 9. Bob publishes s and r.

But it is easy to see that the process of 1 to 9 can be easily broken. For example, one of the easiest way to break the above process is to select r at step 3. After this, the attacker can find out k from step 4 onwards.

I do not see the main flaw with this attack. But I was told by many cryptographers that this attack is very dangerous.

So what is the flaw in the above attack? The main flaw in the above attack is that Bob calculates s = r' mod n at step 8. This is a huge weakness in Diffie-Hellman key exchange. It is easy for the attacker to calculate s.

What is the disadvantage of Diffie-Hellman?

Diffie-Hellman is the one-time-pad cryptographic protocol, or, more precisely, a protocol that is based one-time-pad. However, Alice and Bob don't know each other's identity. The first question that you might ask is: how can they agree on a secret key, if they don't know each other's identity?

The main disadvantage of Diffie-Hellman is that it requires perfect secrecy. Let us describe it in a simple way. In other words, if Alice and Bob do not use the perfect secrecy Diffie-Hellman protocol, then it is not possible to ensure that no third party listens to their communication. The reason why it is not possible is that the only thing that is needed to ensure this privacy is the ability to encrypt (and decrypt) a message. If Alice and Bob do not use Diffie-Hellman, then Alice and Bob can always encrypt and decrypt a message, but nothing prevents Alice from monitoring their communication and learning Bob's identity. Thus, Diffie-Hellman does not provide perfect privacy.

If Alice and Bob use perfect secrecy Diffie-Hellman, then it is possible to prevent a third party from listening to their communication. Therefore, Diffie-Hellman is not perfect: it only provides privacy against a passive attacker. However, Diffie-Hellman is very useful for practical purposes, because it is the only practical protocol that can be used to establish a secret key between two parties, without knowing each other's identity.

Is there any protocol that allows two parties to establish a secret key without knowing each other's identity? In particular, we are interested in secret key agreement protocols that are based on perfect secrecy.