I understand the "sudden death" implications of reusing a nonce with ChaCha20-poly1305, but I believe this rule doesn't apply if you are transmitting exactly the same packet.
I'm putting together a small radio protocol where packets can be lost and if an ack isn't received the packet is re-transmitted. In this instance the nonce is reused, but I can't see that an attacker has any more useful information than the initial packet. I would presume that the key is still safe. Is this correct or have I missed something obvious?
It is a custom protocol, based on a resource requirement that prevents going with something like 6LoWPAN.
I was not going to use random nonces, but rather sequential nonces, with the top 32 bits of the 96 bit nonce set to the 32 bit node address that the packet comes from. The problem with this is reliably storing the nonce in flash with limited erase / write cycles. Although I have seen implementations save blocks of nonces, rather than every use.
I can gather entropy from concatenating the lowest bit of multiple reads of the signal strength from the radio, but I would guess that sequential nonces are safer to use, if I can guarantee they are sequential.
I was thinking of using a network registration method where the node, on power up, would have a preshared RX encryption key, but no TX encryption key. The node would ask for network registration where a master node (server) would send a new TX key encrypted and authenticated. If correctly received the new node would use the new TX key and the nonce would start again from 0. This would get around the problem of storing the nonce at the expense of a slight delay in network registration. This network is only designed to be local to a single site, all nodes within reception of each other.