# Sponge Duplex authenticated encryption with nonce reuse or no nonce

With a Sponge permutation in a Duplex construction for authenticated encryption.

illustration example: ascon; actual interest if relevant: keccak

Suppose there is no associated data and there is no nonce, just a key. A classical xor-cipher problem arises with the first cipher-text block where

$$C_{a,1}\oplus C_{b,1}= P_{a,1}\oplus P_{b,1}$$. - for two streams $$a$$ and $$b$$ with the same key

• but it would appear that subsequent blocks are fine.

However, suppose instead of associated data you insert $$P_1$$ (and then repeat $$P_1$$ again and proceed normally as per the construction)

Basically Using $$P_1$$ as a nonce. But then every subsequent $$P_x$$ is an additional nonce of sorts.

Would you not have a situation where you end up with a stream cipher that will be in no danger of nonce (nonce being 0*) reuse? Every duplex instance using the same key would only produce identical $$S_1\ldots S_x$$ for identical $$P_1\ldots P_x$$ ($$S_x$$ being $$C_x\oplus P_x$$ or the "public" part of the sponge permutation)

Is this correct? And if so, is the only downside of this approach the fact that identical plaintext will always produce identical ciphertext & tag? No other security implications?

You would still have the XOR-cipher problem for pairs of plaintext where $$P_{a,1}=P_{b,1}$$. This is quite a credible condition as messages can often have stereotyped beginning such as "Dear Sir/Madam" or "CLASSIFICATION: TOP SECRET".
If we have two messages where $$P_{a,1}=P_{b,1}$$, then the state coming out of $$p_b$$ after the "associated data" step is equal for both messages. We then see that $$C_{a,1}$$ and $$C_{b,1}$$ are also equal as are the two states and for the next block we'd have $$C_{a,2}\oplus C_{b,2}=P_{a,2}\oplus P_{b,2}$$.
There's also the question of how the recipient is supposed to recreate the stream. They have no knowledge of $$P_1$$ and so cannot reproduce the state coming out of $$p_b$$ after the "associated data" step unless $$P_1$$ is transmitted in the clear.