# In the STS Authentication Protocol, why are the signatures encrypted?

From Wikipedia:

(1) Alice → Bob : g^x
(2) Alice ← Bob : g^y, E_K(S_B(g^y, g^x))
(3) Alice → Bob : E_K(S_A(g^x, g^y))


I know there should be something I'm missing, but I cannot think of why E_K(...) is used. Isn't the signature sufficient? Even if there was a MITM, having S_B(...) or S_A(...) isn't very useful. What am I missing here?

-
That protects Alice's identity from active attackers, and protects Bob's identity from passive eavesdroppers. Also, that provides some protection against identity misbinding attacks, $\hspace{1.91 in}$ although not as much as a good protocol should. $\;$ –  Ricky Demer May 7 '14 at 4:00
I'm aware of Unknown Key-Share Attacks, though not particularly worried about them. Could you explain the attacks on Alice's and Bob's identities? –  Logan May 7 '14 at 4:08
If the signatures weren't encrypted, then an eavesdropper with a signature verification key could, with overwhelming accuracy, determine whether or not that key was used in the interaction, by just running the verification algorithm. $\;$ –  Ricky Demer May 7 '14 at 4:13
What, by verifying S_B(g^y,g^x) and S_A(...), we know that K=g^(xy) is used? That doesn't seem to be much of an attack on anything... You might have to spell it out a bit more explicitly. :( –  Logan May 7 '14 at 4:22
OH. WAIT. I think I got ya. The encryption prevents eavesdroppers from knowing that it was actually Alice and Bob rather than two unknown entities? In which case it's not so much a security concern and could be left out if you were so inclined to ignore privacy? –  Logan May 7 '14 at 4:24

$\;$ keeps the identity of the initiator (Alice) confidential, even against active attackers
$\;\;\;\;$ and
$\;$ keeps the identity of the responder (Bob) confidential against passive eavesdroppers
$\;\;\;\;$ and
$\;$ provides some protection against identity misbinding attacks,
$\;$ although not as much as a good protocol should have