# What info should be signed with a digital signature to provide entity authenticaton for DH?

1. $i \to r\colon\; g^x\bmod p$
2. $r \to i\colon\; g^y, \langle g^y,g^x\rangle_r$
3. $i \to r\colon\; \langle g^x,g^y\rangle_i$

Looking at run 2, I am trying to work out why it is necessary to include $g^x$ in the digital signature. Since $r$ is providing the digital signature to provide entity authentication for its public key, $i$'s public key should not need to be included in the digital signature.

Am I right in thinking the message that is being signed must be the same as the message that is being sent? Therefore run 2 should also send $i$'s public key if the digital signature is computed over both of them?

This must surely be adding redundancy and therefore inefficiency to the message.

Thoughts?

You need to hash more data if you include $g^x$, but the cost of hashing a public key is quite low.
If you don't know, original OTR signs only its own $g^x$. The paper here