Why does spiped use both nonces and ephemeral keys? Colin Percival's spiped utility uses a pre-shared key and Diffie-Hellman with ephemeral keys to provide forward secrecy.  The protocol is summarized in the project's README under the section "Encrypted Protocol".

What is the purpose of the nonces (nonce_C and nonce_S)?  How are they useful when x_C and x_S are already chosen at random?
Without the nonces, one could violate explicit authentication

by replaying the group_element || MAC_tag messages.