"He says that is impossible and you need B's key to impersonate B when talking to A." Indeed this is what you'd expect out of any secure handshake, right? But t

"He says that is impossible and you need B's key to impersonate B when talking to A." Indeed this is what you'd expect out of any secure handshake, right? But that's not the case with the novice Tox one: The handshake depends on forming a shared secret. They do by computing an ECDH, which has the property: ECDH(private A, public B) = ECDH(private B, public A) So, if you control private A, you can form the shared secret that A relies on for verifying anybody else's identity. Reasonable AKEs protect against this; Tox's naive one does not. So, instead of requiring two compromised keys for a man in the middle between one peer pairs (A<-->B), you only need one compromised key for a man in the middle between infinite key pairs (A<-->{everybody}).