However, I don't understand that if the public keys of the two parties are known to each other, what would be the point of using DH at all? One of them can just propose a shared key k, compute its hash value and send the (k, h(k)) encrypted with the other one's public key.
Actually, this is not how Diffie-Hellman works at all.
Diffie-Hellman is not a public-key encryption scheme. It is a key agreement scheme.
The difference being that with key agreement, neither Alice nor Bob has any say in what the resultant shared secret ends up being. They both arrive at a mutually shared secret, but it is not selected explicitly by either of them.
With public-key encryption being used for key exchange, then yes, one of them could pick a random $k$, encrypt the result, then send it to the other party.
I appreciate if anyone can clarify the benefit of using DH in case of known public keys.
- Smaller parameters, which implies faster processing
- Especially so for Elliptic Curve Diffie-Hellman
- If the public keys are both known already, then computing the shared secret requires no network traffic
- No/less concern about the shared secret being of low quality
- If Alice sends $k$ to Bob, and Alices machine has insufficient entropy and/or a poor quality random number generator, then $k$ can be guessed by an adversary
- If both DH private keys are sufficiently strong, then the shared secret should be so as well