FWIW: I followed up on the "slapping both modes together" part: if you assume both parts work individually, PBKDF2's them together as part of the transport reke

FWIW: I followed up on the "slapping both modes together" part: if you assume both parts work individually, PBKDF2's them together as part of the transport rekeying: https://github.com/oxy-secure/transportation/blob/9cf9356ad50a5b933529d824a480179b4ffd0460/src/encrypted_transport.rs#L63 https://github.com/oxy-secure/transportation/blob/9cf9356ad5... The code relying on that just extends the generated key with the statically found key, so it appears to be fine as long as you just chuck enough entropy in. So it appears an empty shared secret would just do what you'd expect: just the DH bit.