The benefit of including an
ss computation is to improve authentication guarantees in some scenarios where ephemeral randomness may be weak. One of the goals of the Noise framework is to provide resistance against Key-Compromise Impersonation (KCI) for the relevant patterns (not all patterns provide this guarantee). The
ss computation strengthens authentication in the scenario described here after (The context for KCI attacks is given at the end).
ss: Consider an (arguably strange) scenario where the ephemeral key used by the receiver is compromised. A more realistic view would be a degradation of the randomness source the receiver uses. In this case, it is easy for an attacker to impersonate any sender to the receiver by simply computing the right
es. This attack would be mitigated if neither of the long-term secrets would be compromised at this point, and that's how the
ss computation helps.
More rationale for
ss is discussed here.
Context on KCI attacks:
In short, KCI is an attacker where a compromise of Alice's long-term key allows an attacker to impersonate anyone to Alice. So, the
es pattern helps in that regard, assuming that Alice's ephemeral secret is not compromised and the sender's (e.g., Bob) long-term secret is not compromised. (Anyway, once the sender's long-term secret is compromised, they can be impersonated arbitrarily. That's not really an attack on the protocol).