I am not very familiar with cryptography. And when I read the above question and answers, I don't understand the points. Even with some ressources online, it's still unclear to me, due to the underlying hypothesis is not clearly stated.
For example, when people talk "Protocol A is not secure...", they are talking abut "The variant version 1 of protocol A is not secure...". However, variant version 2 may be secure, under another context.
Finally, I understand the STS protocol. To help future confused people like I were, here is my attempt to clarify the problems and answers about STS protocol.
All the following screenshots are obtained (with and without minor
modification) from Example:the Diffie-Hellman Key Exchange - EE,
The basic DH protocol : To which identity you are communicating?
I never think about this question! I were always assuming that they both know the identity of the other party.
And we have Man-in-the-middle attack (Easy to find and understand how it works for basic DH).
The basic DH protocol including identity : So we include the identities.
But the identities don't provide anything useful. Man-in-the-middle attack still works.
The basic authenticated DH protocol (with identity) (= Basic STS protocol without encryption)
So your (modified) question is : Why this version is not secure?
The basic authenticated DH protocol is not secure
The basic authenticated DH protocol without identity (Your original question, which is also the version that I asked myself before.)
Under the hypothesis(!!) that they both know the identity of the other party, and the public keys are binded to correct identities.
then just with the signature scheme, the protocol is fine.
The Station-To-Station protocol
Con's (Usually, we assume that the public key is binded to the correct identity)
But we always ask further, and what if the above hypothesis is not satisfied?