How do applications set up secure communications through an untrusted middleman? I recently discovered Tox whilst looking for alternatives to Skype, and while the Tech FAQ goes into some details about algorithms used, etc. I don't understand how keys are securely exchanged.

I understand that at least the following takes place:


Asymmetric keys are used to exchange a symmetric key.
Symmetric keys are used for exchange of chat messages.


From reading this question, it seems that it's not possible to establish such a communication with no prior shared information. With that being the case, it seems that the user id (which is quite long) is the only piece of information shared between clients before establishing communication through the interim untrusted server. I assume this is used in some way to prove the identity.

My question, therefore, is how are symmetric keys exchanged in such a way that the interim server can't perform a MITM attack (by presenting itself to Client A as Client B, and by presenting itself to Client B as Client A)?

If my question has been asked before, please feel free to flag it as a duplicate.
There is no way to establish a shared key with a man in the middle attack and no trusted third party.

With a trusted third party, they can validate public keys so that the man in the middle can't send his.