Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
As far as I understand, nonces must not be reused because their reuse allows public key encryption to be broken.
If I use NaCl's crypto_box http://nacl.cr.yp.to/box.html to encrypt two different plaintexts with the same secret key and nonce, can an observer of these messages recover the secret key and nonce?
If so, how?
P.S. Sorry, tagged as libsodium as there wasn't an NaCl tag.
Short answer: No, the key and the nonce cannot be recovered from a ciphertext.
Longer answer with a big "but": The encryption in crypto_box is done using XSalsa20 which is a stream cipher.
All stream ciphers create a Key Stream $S$ and encryption of the message $M$ is then done using XOR addition: $C=M \oplus S$. Since the key steam only depends on the key and the nonce, you will get the same one in case of a nonce reuse.
From the properties of XOR follows, that I'd you add two ciphertexts, you'll end up with the XOR sum of the plain texts $C_1 \oplus C_2$. So if you know any plain text, you can easily recover every other message encrypted with the same key & nonce combination.
