# Can high-entropy data be reconstructed from plaintext XORs in CTR nonce reuse?

(My interest is academic; I certainly have no intention of rolling my own crypto, especially the known-broken type!)

I know that if the nonce gets reused in a CTR stream, the two cipher blocks can be XOR'ed together to produce a XOR of the plaintexts. From there, the plaintext is recovered using analysis, such as searching for words. This makes unathenticated memory encryption, used in practice, insecure against someone who can edit the counter and trigger reuse.

But my understanding is that such analysis is enabled by the very low entropy of sample plaintexts - the usual examples are English text or bitmap images, which only use a small fraction of the block's information capacity.

Since txt files and bitmaps are relics at this time (easily found in OS files, though), could the attacker still recover the key from XORs of higher-entropy plaintexts in modern data formats?

Specifically to consider .docx, which is compressed with zip (weak compression), and lossy-compressed images or video (high entropy, but they include structure and headers, and can be useful even if severely damaged).

What if the nonce was reused many times, giving the attacker a much larger amount of information? I have a feeling that there might be some mathematical limit, e.g. best-case plaintext recovery requiring at least 1-(1-(entropy/Shannon_limit))^number_of_pairs>entropy/Shannon_limit.

But no idea if that holds, or if there are techniques to reconstruct plaintexts from XORs of general-case data, rather than specific kinds such as natural language.

• Note that attacks become a lot stronger when the key-stream is used more than two times. – CodesInChaos Feb 12 '18 at 16:34
• Possible duplicate of Decrypting two XORed compressed messages? – Meir Maor Feb 12 '18 at 17:21
• Thanks, that question helped me get the idea. Mine is somewhat similar, but I'm interested in a more general case. If the plaintext or the key indeed can't be recovered, unless the plaintext contains easily analyzed content like uncompressed natural language, does that mean that even reused XOR pads still end up securing practical data? – ZOMVID-20 Feb 12 '18 at 17:54
• I flagged as duplicate, but now I notice though the question is similar to the one I asked, my question doesn't actually have much in the way of answers. It has content in comments and in the history of the accepted answer which was retracrted for being false. – Meir Maor Feb 12 '18 at 18:16

What happens when you reuse the stream? It allows an attack to take their knowledge of one plaintext and use that knowledge to expose information about the other plaintext. If you encrypt all-zeros as the plaintext (or any message entirely known by the attacker) then the attacker knows the stream and can perfectly decrypt the second message, no matter what that message is. If, for the re-used portion of the stream, you encrypt two different perfectly random and secret bitstrings then the attacker will learn the relation between the bitstrings, $M_1 \oplus M_2$ but nothing more.