# Why does SpongeWrap not need a Nonce?

The AEAD scheme SpongeWrap based on the sponge construction gets only a header (additional data), a body (the message) and a key as input values, according to the paper where it is defined.

What is missing compared to other AEAD schemes is a nonce to make the key stream unique. I am wondering, why this is possible. The way I understand it, the sponge state for the first message block only depends on the key and the AD, thus an adversary is able to decrypt at least that first block, if key and AD are reused.

For privacy, we consider only adversaries who respect the nonce requirement. For a single header-body pair, it means that, for any two queries $(A, B)$ and $(A′, B′)$, we have $A = A′ ⇒ B = B′$. In general, the nonce requirement specifies that for any two queries $(\overline{A, B})$ and $(\overline{A′, B′})$ of equal length $n$, we have $${\rm pre}(\overline{A, B}) = {\rm pre}(\overline{A′, B′}) ⇒ B^{(n)} = B′^{(n)},$$ with ${\rm pre}(\overline{A, B}) = (A^{(1)}, B^{(1)}, A^{(2)}, \dots , B^{(n−1)}, A^{(n)})$ the sequence with the last body omitted. As for a stream cipher, not respecting the nonce requirement means that the adversary can learn the bitwise difference between two plaintext bodies.