Why is (gy, gx) signed in STS (station-to-station)? My question relates to the station-to-station protocol as described in https://en.wikipedia.org/wiki/Station-to-Station_protocol [1] and http://cacr.uwaterloo.ca/hac/ [2] p 519.

(1) Alice → Bob : gx
(2) Alice ← Bob : gy, EK(SB(gy, gx))
(3) Alice → Bob : EK(SA(gx, gy))


I fail to understand the reasons behind why Bob signs gy+gx (concatenated) and Alice signs gx+gy. [1, 2] say the order of gx and gy is important. Why? And why sign gy+gx? Are there variants of what is signed? A random challenge could be included?
The 1992 paper http://people.scs.carleton.ca/~paulv/papers/sts-final.pdf by Diffie et al answers the question. It has an example of an insecure variant of the protocol that uses signatures of random challenges. Furthermore, the section "Signing only one’s own exponential" considers a variant where Alice signs only gx. According to the paper, there is an attack on this variant when RSA signatures are used. And it seems open to replay attacks (see DuBuisson's answer).

The section "Signing only the other party’s exponential" considers the variant where Alice signs only gy. For this case the authors of the paper say: "we know of no general attack which applies to this case, but there are some concerns". One concern is that "it is imprudent to sign arbitrary text supplied by a potential adversary".