As far as I understand, nonces must not be reused because their reuse allows public key encryption to be broken.

If I use NaCl's crypto_box http://nacl.cr.yp.to/box.html to encrypt two different plaintexts with the same secret key and nonce, can an observer of these messages recover the secret key and nonce?

If so, how?

P.S. Sorry, tagged as libsodium as there wasn't an NaCl tag.

  • 2
    $\begingroup$ Consequences of nonce reuse depend a bit on the mode of operation, e.g. in GCM nonce reuse exposes the signing key. $\endgroup$ – puzzlepalace Jul 11 '17 at 22:31

Short answer: No, the key and the nonce cannot be recovered from a ciphertext.

Longer answer with a big "but": The encryption in crypto_box is done using XSalsa20 which is a stream cipher.

All stream ciphers create a Key Stream $S$ and encryption of the message $M$ is then done using XOR addition: $C=M \oplus S$. Since the key steam only depends on the key and the nonce, you will get the same one in case of a nonce reuse.

From the properties of XOR follows, that I'd you add two ciphertexts, you'll end up with the XOR sum of the plain texts $C_1 \oplus C_2$. So if you know any plain text, you can easily recover every other message encrypted with the same key & nonce combination.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.