# Symmetric (in the execution of the protocol by the two parties) version of the Station-To-Station protocol?

The original Station-To-Station (STS) protocol is as following:

1. Alice : Generate $x$
2. Alice → Bob : $g^x$
3. Bob : Generate $y$, compute $g^y$
4. Bob : Compute $K = (g^x)^y$
5. Bob : Sign-then-Encrypt $(g^y, g^x)$ to obtain $E_K(S_B(g^y, g^x))$
6. Bob → Alice : $g^y$, $E_K(S_B(g^y, g^x))$
7. Alice : Compute $K = (g^y)^x$
8. Alice : Decrypt $E_K(S_B(g^y, g^x))$ using $K$ to obtain $S_B(g^y, g^x))$
9. Alice : Verify $(g^y, g^x)$, $S_B(g^y, g^x))$ using Bob's public key for signature.
10. Alice : Sign-then-Encrypt $(g^x, g^y)$ to obtain $E_K(S_A(g^x, g^y))$
11. Alice → Bob : $E_K(S_A(g^x, g^y))$
12. Bob : Decrypt $E_K(S_A(g^x, g^y))$ using $K$ to obtain $S_A(g^x, g^y))$
13. Bob : Verify $(g^x, g^y)$, $S_A(g^x, g^y))$ using Alice's public key for signature.

In this paper Authentication and Authenticated Key Exchanges, it mentioned that

Here is my thought about a symmetric version:

1. Alice : Generate $x$
2. Bob : Generate $y$
3. Alice → Bob : $g^x$
4. Bob → Alice : $g^y$
5. Alice : Compute $K = (g^y)^x$ and $E_K(S_B(g^y, g^x))$
6. Bob : Compute $K = (g^x)^y$ and $E_K(S_B(g^y, g^x))$
7. Alice → Bob : $E_K(S_A(g^x, g^y))$
8. Bob → Alice : $E_K(S_B(g^y, g^x))$
9. Alice : Decrypt-then-verify
10. Bob : Decrypt-then-verify

In fact, I got this thought first, but I am not sure if it is secure as the original STS protocol. So I try to find a reference online. However, I didn't obtain a confirmation.

Does this symmetric (in the execution of the protocol by the two parties) version have problems?