What goes wrong if we use the same key k in deterministic counter mode to encrypt two different plaintext messages m0 /= m1.
It is not true that c0 = c1, because we XOR output of m0 with input of m1 in counter mode. As a result, c0 cannot equal c1, and c1 cannot be said to be the same as c0.
Could this be true?
Attacker find two c0 and c1, then find m0 and m1.
Currently, attackers can check all new messages they send or receive. He found the key using ciphertext and plaintext.