TL;DR: Why is there a static-static diffie hellman in the Noise_IK handshake?
Hi, I am currently trying to understand the WireGuard VPN protocol. As you may know, it uses the Noise_IK handshake from the Noise Protocol Framework.
This handshake uses two ephemeral-static diffie hellman operations (es and se) to authenticate the initiator and the responder. Then why is there a static-static (ss) diffie hellman needed? Why is it necessary?
Thanks for your answers in advance!
The benefit of including an ss computation is to improve authentication guarantees in some scenarios where ephemeral randomness may be weak. One of the goals of the Noise framework is to provide resistance against Key-Compromise Impersonation (KCI) for the relevant patterns (not all patterns provide this guarantee). The ss computation strengthens authentication in the scenario described here after (The context for KCI attacks is given at the end).
Benefits of ss: Consider an (arguably strange) scenario where the ephemeral key used by the receiver is compromised. A more realistic view would be a degradation of the randomness source the receiver uses. In this case, it is easy for an attacker to impersonate any sender to the receiver by simply computing the right es. This attack would be mitigated if neither of the long-term secrets would be compromised at this point, and that's how the ss computation helps.
More rationale for ss is discussed here.
Context on KCI attacks:
In short, KCI is an attacker where a compromise of Alice's long-term key allows an attacker to impersonate anyone to Alice. So, the es pattern helps in that regard, assuming that Alice's ephemeral secret is not compromised and the sender's (e.g., Bob) long-term secret is not compromised. (Anyway, once the sender's long-term secret is compromised, they can be impersonated arbitrarily. That's not really an attack on the protocol).
