Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

From Wikipedia:

(1) Alice → Bob : g^x
(2) Alice ← Bob : g^y, E_K(S_B(g^y, g^x))
(3) Alice → Bob : E_K(S_A(g^x, g^y))

I know there should be something I'm missing, but I cannot think of why E_K(...) is used. Isn't the signature sufficient? Even if there was a MITM, having S_B(...) or S_A(...) isn't very useful. What am I missing here?

share|improve this question
That protects Alice's identity from active attackers, and protects Bob's identity from passive eavesdroppers. Also, that provides some protection against identity misbinding attacks, $\hspace{1.91 in}$ although not as much as a good protocol should. $\;$ – Ricky Demer May 7 '14 at 4:00
I'm aware of Unknown Key-Share Attacks, though not particularly worried about them. Could you explain the attacks on Alice's and Bob's identities? – Logan May 7 '14 at 4:08
If the signatures weren't encrypted, then an eavesdropper with a signature verification key could, with overwhelming accuracy, determine whether or not that key was used in the interaction, by just running the verification algorithm. $\;$ – Ricky Demer May 7 '14 at 4:13
What, by verifying S_B(g^y,g^x) and S_A(...), we know that K=g^(xy) is used? That doesn't seem to be much of an attack on anything... You might have to spell it out a bit more explicitly. :( – Logan May 7 '14 at 4:22
OH. WAIT. I think I got ya. The encryption prevents eavesdroppers from knowing that it was actually Alice and Bob rather than two unknown entities? In which case it's not so much a security concern and could be left out if you were so inclined to ignore privacy? – Logan May 7 '14 at 4:24
up vote 5 down vote accepted

The encryption of the signatures

$\;$ keeps the identity of the initiator (Alice) confidential, even against active attackers
$\;\;\;\;$ and
$\;$ keeps the identity of the responder (Bob) confidential against passive eavesdroppers
$\;\;\;\;$ and
$\;$ provides some protection against identity misbinding attacks,
$\;$ although not as much as a good protocol should have


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.