# Streaming mode of operation that is more resistant against nonce reuse

Is it possible to create a streaming mode of operation where the reuse of a nonce does not destroy confidentiality?

In this question it would be allowed for the streaming mode to leak if ciphertexts are (partially) identical or not - like in CBC mode of operation. It is of course not permitted to introduce other secrets or random values other than the key and original nonce.

I've got the feeling that this is only possible by mixing in information from the plaintext, but that would make the cipher much less efficient.

-
A blockcipher in CFB mode only leaks the xor of the first block that differs and not the xor of the whole message. I think keccak's duplex mode has similar properties. –  CodesInChaos Aug 10 '14 at 18:19
The SIV mode (Synthetic IV) is designed as misuse resistant, but it requires the plaintext to be processed twice. So probably not what you are looking for. –  Thor Aug 10 '14 at 18:44
@Thor SIV actually comes a long way. It seems size efficient, but not very efficient with regards to CPU time. Thanks! –  Maarten Bodewes Aug 11 '14 at 0:22
When I thought about this before, the candidate that I came up with was letting each block's key be the result of applying a PRF to the previous block (starting with the IV). $\;$ –  Ricky Demer Aug 11 '14 at 5:21
Regarding CFB, cf. crypto.stackexchange.com/questions/5423/… –  otus Aug 11 '14 at 5:48