I understand that NaCl's
crypto_stream_xor don't do any authentication, like
crypto_secretbox does. What I want to ask is, does using them allow listeners to forge
crypto_secretbox messages for any key you use them with?
What I'm worried about is a known plaintext attack. If I use
crypto_stream_xor to encrypt a bunch of zeroes, then the listener now has the full keystream for whatever nonce I just used. I think they can use the first 32 bytes of that as a
crypto_onetimeauth key to forge valid authenticators for
crypto_secretbox messages, with whatever plaintext they want (up to the length of the zeroes I encrypted, minus 32).
If that's right, then using
crypto_stream_xor seems to breaks authenticity just as badly as nonce reuse does. The NaCl/libsodium documentation is pretty clear about saying "never reuse a nonce with the same key", but there's nothing in there about "never use
crypto_stream_xor with a key that you also use for