The benefit of including an ss
computation is to improve authentication guarantees in some scenarios where ephemeral randomness may be weak. One of the goals of the Noise framework is to provide resistance against Key-Compromise Impersonation (KCI) for the relevant patterns (not all patterns provide this guarantee). The ss
computation strengthens authentication in the scenario described here after (The context for KCI attacks is given at the end).
Benefits of ss
: Consider an (arguably strange) scenario where the ephemeral key used by the receiver is compromised. A more realistic view would be a degradation of the randomness source the receiver uses. In this case, it is easy for an attacker to impersonate any sender to the receiver by simply computing the right es
. This attack would be mitigated if neither of the long-term secrets would be compromised at this point, and that's how the ss
computation helps.
More rationale for ss
is discussed here.
Context on KCI attacks:
In short, KCI is an attacker where a compromise of Alice's long-term key allows an attacker to impersonate anyone to Alice. So, the es
pattern helps in that regard, assuming that Alice's ephemeral secret is not compromised and the sender's (e.g., Bob) long-term secret is not compromised. (Anyway, once the sender's long-term secret is compromised, they can be impersonated arbitrarily. That's not really an attack on the protocol).