Tor Diffie-Hellman question

[Keith Needels <keithn@xxxxxxxxxxx>]

Hello,

I just read through the design paper (Tor: The Second Generation Onion 
Router), and I have a quick question that I'm sure one of you can answer.

I might be missing something obvious here, but if the first half of the 
Diffie-Hellman key exchange sent with the Create/Relay Extend commands 
is encrypted using RSA and the public key of the onion router in which 
it is destined, why do Diffie-Hellman at all?  Why not just have our 
Alice generate the AES key by herself, and send it down the circuit 
encrypted with the destination OR's public key?

Thanks a lot!

-Keith