- $i \to r\colon\; g^x\bmod p$
- $r \to i\colon\; g^y, \langle g^y,g^x\rangle_r$
- $i \to r\colon\; \langle g^x,g^y\rangle_i$
Looking at run 2, I am trying to work out why it is necessary to include $g^x$ in the digital signature. Since $r$ is providing the digital signature to provide entity authentication for its public key, $i$'s public key should not need to be included in the digital signature.
Am I right in thinking the message that is being signed must be the same as the message that is being sent? Therefore run 2 should also send $i$'s public key if the digital signature is computed over both of them?
This must surely be adding redundancy and therefore inefficiency to the message.