I am looking at a cryptographic protocol in a somewhat unusual environment: the communicating parties can share arbitrarily long secret keys over a secure channel.
If forward secrecy is not required, it seems that one can simply encrypt/authenticate a (random) 256-bit key using the 256-bit shared secret, and then start sending messages encrypted using ChaCha20-Poly1305 (or AES-GCM). This seems to be trivially secure assuming that the underlying ciphers are secure (Proof: The attacker cannot forge or reorder messages after the first without breaking the AEAD or knowing its key -- but to obtain the key the attacker would need to break XSalsa20-Poly1305 or the CSPRNG used, or the 192-bit nonce of XSalsa20-Poly1305 would need to be reused, or the shared secret would need to be leaked. The AEAD and XSalsa20-Poly1305 are both widely believed secure, the shared secret must be assumed secret, and the probability of a 192-bit nonce collision is negligible). A counter starts at 0 each time, serving as both message sequence number (to prevent reordering) and nonce.
TLS-PSK is designed for this, but it is extremely complex. This seems much simpler.