In ChaCha20-Poly1305, I know that reusing a nonce loses confidentiality and integrity for all messages encrypted with the (key, nonce) pair.
However, is security affected for those messages encrypted with the same key but different nonces?
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this communityIn ChaCha20-Poly1305, I know that reusing a nonce loses confidentiality and integrity for all messages encrypted with the (key, nonce) pair.
However, is security affected for those messages encrypted with the same key but different nonces?
If you reuse a nonce, you lose confidentiality for the messages with that nonce. Messages with other nonces retain their confidentiality.
However, the attacker can also attack the MAC part (Poly1305) and generate a third and more messages with the same nonce. See: Why is Poly1305 popular given its 'sudden death' properties?
So unless you have a way to rule out messages with that nonce in the future, for example due to the protocol enforcing a new nonce each time, you cannot trust messages encrypted with that key any more. If you can rule them out, messages with other nonces cannot be forged, because the MAC key is generated from the encryption key and the nonce.