What are the potential (major) flaws in this security scheme? It’s been a few years since I read anything involving crypto. I’ve come across this scheme and I wonder how secure it is:


Alice generates an RSA keypair (we assume Alice is using proper random numbers).
Alice sends the public key as plain text to Bob.
Bob generates a 3DES session key: BA.
Bob sends BA encrypted with Alice’s public key, together with a checksum of BA.
Alice receives and decrypts BA using its private key.
All following sensitive data is encrypted with BA and integrity is checked via the checksum.
When the checksum fails communication is aborted and Alice generates a new keypair.


What are the potential (or very real) problems with this scheme?
One real problem is that lack of authentication between the two sides.  Here's one possible problem:

Alice generates an RSA keypair (we assume Alice is using proper random numbers)
Alice sends the public key as plain text to Bob.

Eve intercepts this message, and forwards on a message to Bob with her public key

Bob generates a 3DES session key: BA
Bob sends BA encrypted with [Eve]'s public key, together with a checksum of BA

Eve intercepts this message, and decrypts it with her private key, giving her the value of BA.  She then takes BA and the checksum, and encrypts it with Alice's public key, and sends that on to Alice

Alice receives and decrypts BA using its private key.
all following sensitive data is encrypted with BA and integrity is checked via the checksum.

That is, all sensitive data is encrypted by a key that Eve knows.  Furthermore, she can modify anything she wants.
In general, you cannot really have secure communication unless you know who you're actually communicating with.  In this case, Bob has no reason to believe that the public key he gets is from Alice, and not someone impersonating Alice.