Rationale of "r" AES key use in OTR version 3 AKE protocol?

Question

I just tried to review & understand AKE (Authenticated Key Exchange) protocol as defined in OTR secure messaging protocol version 3 here , and aiming to achieve Perfect Forward Secrecy

I am a little bit confused with the described handling of the "r" aes key in the presented DHE (Ephemeral Diffie-Hellman) protocol:

• DHE is used in asymmetric way : g^x is sent encrypted with r aes key by Bob while g^y is sent in clear form by Alice

• then r (step 7) is further sent in clear form by Bob so that g^x is recovered by Alice

What may be the rationale for such r aes key use which seems very strange to me ?

• is g^x to be temporarily hidden to Alice until Bob check that g^y has legal value ?

• I surely missed the real reason

Answer 1

The usage of the r key forces both parties to "fix" the public DH keys.

So Alice doesn't know Bob's public DH key before she's generating her own one.

And Bob can not make the choice of the public key dependant on Alice's choice and vice versa.

This forces both parties to be honest and to generate both public keys at random as there is no opportunity to force a specific derived key that may have some weak properties.