Are there benefits for using Static Diffie-Hellman over Ephemeral Diffie-Hellman? TL;DR - Are there any benefits to using static DH over ephemeral DH?



I'm reading about the differences between static DH &amp; ephemeral DH  and I am trying to think of one logical reason to use static(-static) DH over ephemeral(-ephemeral) DH.

My understanding of DHE is that it provides Forward Secrecy which is something we want, is it not? FS ensures that if the server private key were to get leaked past communication would be secure correct?

So why would we still want to use static DH? Are there any benefits to this? I would presume that computation is perhaps one factor?
The "advantage" of static DH is that the server doesn't need to compute an exponentiation each time. This advantage is, however, not worth it, in the sense that the static DH problem is easier than the DLOG problem (to the best of our knowledge). In the paper The Static Diffie-Hellman Problem (PS) by Brown and Gallant, they show an attack on the static DH problem for Elliptic curves that is significantly faster than the best known for ephemeral DH.

Note: I would not call static DH "standard"; on the contrary, in my mind, ephemeral is the "standard" version.