I want to modify this peer-to-peer communications software to allow parties to specify a shared secret key and have all communications encrypted with it.
[The software uses tweetnacl.js for the cryptographic operations.]
Re-using the exact same shared secret key for every message does not seem very secure. I have two questions:
Is this concern addressed by the presence of the nonce in
nacl.secretbox(message, nonce, key)thus making it safe to re-use the shared secret key as long as the nonce is different every time? (which is a requirement anyway obviously).
Would it be even safer to derive a unique shared key for each message by hashing some salt and sending the salt along with each message so that the other side can do the same to obtain the unique shared key for the message? Or is this redundant?