What info should be signed with a digital signature to provide entity authenticaton for DH?

Question

1. $i \to r\colon\; g^x\bmod p$
2. $r \to i\colon\; g^y, \langle g^y,g^x\rangle_r$
3. $i \to r\colon\; \langle g^x,g^y\rangle_i$

Looking at run 2, I am trying to work out why it is necessary to include $g^x$ in the digital signature. Since $r$ is providing the digital signature to provide entity authentication for its public key, $i$'s public key should not need to be included in the digital signature.

Am I right in thinking the message that is being signed must be the same as the message that is being sent? Therefore run 2 should also send $i$'s public key if the digital signature is computed over both of them?

This must surely be adding redundancy and therefore inefficiency to the message.

Thoughts?

Answer 1

1. Typical signatures start by hashing the message. Thus including more data in a signature doesn't increase the size of the signature, if the recipient knows what you signed (in this case, remembered what they sent in step 1).

   You need to hash more data if you include $g^x$, but the cost of hashing a public key is quite low.

2. If you didn't include some kind of challenge value in the signature a compromised session key would allow impersonation in future sessions, which is undesirable.

3. I recommend signing all the data exchanged so far (transcript hashing). This leaves much less room for an attacker to manipulate an exchange, which is important, especially for complex protocols like TLS.

Answer 2

If you don't know, original OTR signs only its own $g^x$. The paper here