Ben, > >??? If I HMAC then DH the result, isn't that a signature? No, encrypting a hash (I assumed you meant a hash, not HMAC) for verification by a specified entity (the entity whose public key was an input to the DH computation you performed) isn't a signature. Steve