# In the STS Authentication Protocol, why are the signatures encrypted?

From Wikipedia:

(1) Alice → Bob : g^x
(2) Alice ← Bob : g^y, E_K(S_B(g^y, g^x))
(3) Alice → Bob : E_K(S_A(g^x, g^y))


I know there should be something I'm missing, but I cannot think of why E_K(...) is used. Isn't the signature sufficient? Even if there was a MITM, having S_B(...) or S_A(...) isn't very useful. What am I missing here?

• That protects Alice's identity from active attackers, and protects Bob's identity from passive eavesdroppers. Also, that provides some protection against identity misbinding attacks, $\hspace{1.91 in}$ although not as much as a good protocol should. $\;$ – user991 May 7 '14 at 4:00
• I'm aware of Unknown Key-Share Attacks, though not particularly worried about them. Could you explain the attacks on Alice's and Bob's identities? – Logan May 7 '14 at 4:08
• If the signatures weren't encrypted, then an eavesdropper with a signature verification key could, with overwhelming accuracy, determine whether or not that key was used in the interaction, by just running the verification algorithm. $\;$ – user991 May 7 '14 at 4:13
• What, by verifying S_B(g^y,g^x) and S_A(...), we know that K=g^(xy) is used? That doesn't seem to be much of an attack on anything... You might have to spell it out a bit more explicitly. :( – Logan May 7 '14 at 4:22
• OH. WAIT. I think I got ya. The encryption prevents eavesdroppers from knowing that it was actually Alice and Bob rather than two unknown entities? In which case it's not so much a security concern and could be left out if you were so inclined to ignore privacy? – Logan May 7 '14 at 4:24

The encryption of the signatures

$\;$ keeps the identity of the initiator (Alice) confidential, even against active attackers
$\;\;\;\;$ and
$\;$ keeps the identity of the responder (Bob) confidential against passive eavesdroppers
$\;\;\;\;$ and
$\;$ provides some protection against identity misbinding attacks,
$\;$ although not as much as a good protocol should have

.

I am not very familiar with cryptography. And when I read the above question and answers, I don't understand the points. Even with some ressources online, it's still unclear to me, due to the underlying hypothesis is not clearly stated. For example, when people talk "Protocol A is not secure...", they are talking abut "The variant version 1 of protocol A is not secure...". However, variant version 2 may be secure, under another context.

Finally, I understand the STS protocol. To help future confused people like I were, here is my attempt to clarify the problems and answers about STS protocol.

All the following screenshots are obtained (with and without minor modification) from Example:the Diffie-Hellman Key Exchange - EE, Technion

1. The basic DH protocol : To which identity you are communicating?

I never think about this question! I were always assuming that they both know the identity of the other party.

And we have Man-in-the-middle attack (Easy to find and understand how it works for basic DH).

2. The basic DH protocol including identity : So we include the identities.

But the identities don't provide anything useful. Man-in-the-middle attack still works.

3. The basic authenticated DH protocol (with identity) (= Basic STS protocol without encryption)

So your (modified) question is : Why this version is not secure?

4. The basic authenticated DH protocol is not secure

5. The basic authenticated DH protocol without identity (Your original question, which is also the version that I asked myself before.)

Under the hypothesis(!!) that they both know the identity of the other party, and the public keys are binded to correct identities. then just with the signature scheme, the protocol is fine.

6. The Station-To-Station protocol

7. Pro's

8. Con's (Usually, we assume that the public key is binded to the correct identity)

But we always ask further, and what if the above hypothesis is not satisfied?