1. $i \to r\colon\; g^x\bmod p$
  2. $r \to i\colon\; g^y, \langle g^y,g^x\rangle_r$
  3. $i \to r\colon\; \langle g^x,g^y\rangle_i$

Looking at run 2, I am trying to work out why it is necessary to include $g^x$ in the digital signature. Since $r$ is providing the digital signature to provide entity authentication for its public key, $i$'s public key should not need to be included in the digital signature.

Am I right in thinking the message that is being signed must be the same as the message that is being sent? Therefore run 2 should also send $i$'s public key if the digital signature is computed over both of them?

This must surely be adding redundancy and therefore inefficiency to the message.


  1. Typical signatures start by hashing the message. Thus including more data in a signature doesn't increase the size of the signature, if the recipient knows what you signed (in this case, remembered what they sent in step 1).

    You need to hash more data if you include $g^x$, but the cost of hashing a public key is quite low.

  2. If you didn't include some kind of challenge value in the signature a compromised session key would allow impersonation in future sessions, which is undesirable.

  3. I recommend signing all the data exchanged so far (transcript hashing). This leaves much less room for an attacker to manipulate an exchange, which is important, especially for complex protocols like TLS.

  • $\begingroup$ Also note that hashing is much more efficient than asymmetric signature generation or key agreement. The cost of putting all messages in the calculation is not that high. $\endgroup$
    – Maarten Bodewes
    Dec 3 '16 at 18:41

If you don't know, original OTR signs only its own $g^x$. The paper here


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.