# Does using crypto_stream_xor allow listeners to forge crypto_secretbox messages?

I understand that NaCl's crypto_stream and crypto_stream_xor don't do any authentication, like crypto_secretbox does. What I want to ask is, does using them allow listeners to forge crypto_secretbox messages for any key you use them with?

What I'm worried about is a known plaintext attack. If I use crypto_stream_xor to encrypt a bunch of zeroes, then the listener now has the full keystream for whatever nonce I just used. I think they can use the first 32 bytes of that as a crypto_onetimeauth key to forge valid authenticators for crypto_secretbox messages, with whatever plaintext they want (up to the length of the zeroes I encrypted, minus 32).

If that's right, then using crypto_stream_xor seems to breaks authenticity just as badly as nonce reuse does. The NaCl/libsodium documentation is pretty clear about saying "never reuse a nonce with the same key", but there's nothing in there about "never use crypto_stream_xor with a key that you also use for crypto_secretbox."

• – CodesInChaos Nov 22 '16 at 18:09

crypto_secretbox uses the first 32 bytes of XSalsa20 output as the key for Poly1305. Thus you are correct that using crypto_stream_xor on a known plaintext will reveal the authentication-key used by crypto_secretbox, allowing forgeries under that key and nonce.