# How to find the secret key and nonce from two messages encrypted using the same nonce?

As far as I understand, nonces must not be reused because their reuse allows public key encryption to be broken.

If I use NaCl's crypto_box http://nacl.cr.yp.to/box.html to encrypt two different plaintexts with the same secret key and nonce, can an observer of these messages recover the secret key and nonce?

If so, how?

P.S. Sorry, tagged as libsodium as there wasn't an NaCl tag.

• Consequences of nonce reuse depend a bit on the mode of operation, e.g. in GCM nonce reuse exposes the signing key. – puzzlepalace Jul 11 '17 at 22:31

All stream ciphers create a Key Stream $S$ and encryption of the message $M$ is then done using XOR addition: $C=M \oplus S$. Since the key steam only depends on the key and the nonce, you will get the same one in case of a nonce reuse.
From the properties of XOR follows, that I'd you add two ciphertexts, you'll end up with the XOR sum of the plain texts $C_1 \oplus C_2$. So if you know any plain text, you can easily recover every other message encrypted with the same key & nonce combination.