Anna and Tom run a key exchange protocol similar to Diffie-Hellman, but using Elgamal.

In the protocol, both Anna and Tom agree on a group described by (p, q, g) . Then Anna chooses a random number x_a Z_q as her private key, and computes h_a = g^x_a mod p. Tom chooses a random number x_b Z_q as his private key, and computes h_b = g^x_b mod p. They give h_a, h_b to each other through a secure, out-of-band channel.

To establish a shared key, they do the following:

1. Anna chooses a random number k_a, encrypts it under Elgamal using Tom's public key (p, q, g, h_b), the resulting ciphertext is (g^r_a, g^k_a h_b^r_a), and the ciphertext is sent to Tom.
2. Tom chooses a random number k_b, encrypts it under Elgamal using Anna's public key (p, q, g, h_a) , the resulting ciphertext is (g^r_b , g^k_b h_a^r_b), and the ciphertext is sent to Anna.
3. Anna decrypts to get g^k_b , and computes (g^k_b)^k_a g^k_ak_b mod p as the shared key.
4. Tom decrypts to get g^k_a , and computes (g^k_a)^k_b g^k_ak_b mod p as the shared key.

Yes/No, is the man-on-the-middle attack in the Diffie-Hellman protocol still possible?