I'm trying to understand the STS protocol (using the wikipedia page as source), but I don't see how this protocol is any more secure than DH regarding man in the middle attacks.
If Alice and Bob don't know each others public keys, and have no secure channels at all, then an attacker (Charlie) could forge asymetric keys (x',x'G) and (y',y'G), and make independant connections between Alice and Bob for each of the 8 steps of the basic STS protocol as described on the wikipedia page. Alice would believe Bob's key is y'G, and vice versa. Charlie would be able to decrypt each of the signatures using the two different shared secrets (xy'G and x'yG), and then sign (y'G,xG) with xy'G and sign (yG,x'G) with x'yG and encrypt them again. So the encryption and signing of the (yG,xG) pair doesn't seem to make any difference to me.
If Alice and Bob have a secure channel allowing them to exchange their public keys then I don't see a way for a MITM attack even with regular DH.
Can someone help me identify where I'm wrong ?