Without the initial exchange of nonces, an attacker could replay a recorded handshake. Although an attacker can't use this to replay actual packets, an attacker could possibly execute a denial of service attack if the process protected by spiped is not expecting a large number of connections.
The attack (assuming a modified spiped protocol that MACs the public keys directly with the long-term key):
- Observe a handshake. Record
y_C || h_C, where
y_C is the client's ephemeral public key and
h_C = HMAC(K, y_C) (
K is the pre-shared key).
- Open a new connection and replay
y_C || h_C. The server sees a valid MAC, and presumably opens a connection to the protected process.
- Repeat #2 until the protected process is overwhelmed.
Thanks to Ricky Demer for the discussion on his answer.