In Diffie-Hellman, can everything be sent in plaintext? I think my limited understanding of DH might be messed up - what's wrong with this scenario?


C wants to connect to S.
C has an ECDSA public key that it trusts belongs to S.


Here's what happens:


C connects to S.
S sends its part of the DH key exchange, signed to prevent tampering*.
C sends over its part of the DH key exchange, in plaintext and without a signature.
C and S now calculate the shared key.
The shared key is used for all further communication.


*Add padding, etc. to prevent forgeries and reuse.

A MitM can't lie to C, because it can't forge the signature, and if it lies to S, it isn't really gaining anything, because if it could effectively pretend to be C without routing everything back through C, it wouldn't have to make a MitM attack in the first place.
TLDR:


Diffie-Hellman key exchange works differently
Yes, DH is vulnerable to MitM.


Long answer:

Diffie-Hellman key exchange isn't about sending the public key with some kind of signature, but about negotiating the key.

Quick DH explaination (note: these values are very insecure):


Alice and Bob publicly agree on two values:


The generator - g. Let's say this is 3.
The prime modulus (obviously a prime number) - p. Let's say this is 17.

Both Alice and Bob think of a secret value, let's call this x


Alice's secret value is 15
Bob's secret value is 13

They calculate yet another values, using this formula: g^x mod p


Alice: 3^15 mod 17 = 6
Bob: 3^13 mod 17 = 12

Alice sends the result to Bob and vice versa
They both calculate the final value like this:


Alice: 12^15 mod 17 = 10
Bob: 6^13 mod 17 = 10

They have negotiated a key and Eve doesn't know what's the value of this key (the negotiation requires a lot of values to be exchanged and therefore simply listening but not participating in the exchange doesn't let you see the established key)


MitM example:

Imagine this "circuit":

Alice -- Eve -- Bob

Eve changed the values when they were exchanging them, decrypts everything that comes from Alice with the key she has exchanged with Alice, and then encrypts it with the key she has exchanged with Bob and vice versa.

Conclusion:

There's a need for some kind of "pre-shared secret" with DH. DH itself is not MitM-proof. For SSL/TLS that is Certificate Authorities. Instant messaging often uses OTR (which involves a question that only the actual other party should be able to answer - pre-shared secret).