I just tried to review & understand AKE (Authenticated Key Exchange) protocol as defined in OTR secure messaging protocol version 3 here , and aiming to achieve Perfect Forward Secrecy
I am a little bit confused with the described handling of the "r" aes key in the presented DHE (Ephemeral Diffie-Hellman) protocol:
DHE is used in asymmetric way : g^x is sent encrypted with r aes key by Bob while g^y is sent in clear form by Alice
then r (step 7) is further sent in clear form by Bob so that g^x is recovered by Alice
What may be the rationale for such r aes key use which seems very strange to me ?
is g^x to be temporarily hidden to Alice until Bob check that g^y has legal value ?
I surely missed the real reason