For building a circuit Alice contacts Bob (OR) and send her pub diffie-hellmann key encrypted with Bobs pub key. Bob sends his public-diffie-hellmann key and the session key hashed ("only" TLS encrypted...) back to Alice.
Encrypting the diffie-key with Bob public's key makes some kind of authentication because only Bob can know Alice public secret and calculate the correct hash. Why is it done that way? In my opinion it is against the diffie-helllmann protocol where p,g,g^(a) are public and authentication is done by signing.
Bob could just sign the answer and everything would be the authenticated.
Could this be some kind of "proof-of-work" to harden against ddos attacks?
