I know how a man-in-the-middle attack on a Diffie-Hellman protocol works and that it is a bug, but I wonder if this attack might be desirable in any situation.