I am working on an implementation based on the Disco library, which itself is based on Noise and strobe framework. The goal is to do bilaterally entity-authenticated key agreement with perfect forward secrecy. Disco already implements Noise_NNpsk2 but does not offer Noise_NKpsk2. I at first considered using Noise_NKpsk2, though the more I think about the the more it seems like Noise_NNpsk2 might work too!
Consider two entities A, B, where B has a key printed in a spot which we can guarantee is only visible to A. Entity B is computationally much weaker and cannot take any pre-messages. Concretely, A is a local server and B is some IoT device without any possibility of user input.
Assume A wants to initiate a handshake with B. If we consider the differences between the two schemes Noise_NNpsk0, Noise_NKpsk2, the only security-relevant differences are that in Noise_NKpsk2 A has the extra authentication measure of the static public key of B. As we assume that the PSK printed on B can only be seen by A, I reckon that the extra assurance of the static public key of B doesn't add anything!
Hence, my question:
What are motivations to go with Noise_NKpsk2 over Noise_NNpsk0 given the assumptions of the "hidden" PSK only visible to A?