(My interest is academic; I certainly have no intention of rolling my own crypto, especially the known-broken type!)
I know that if the nonce gets reused in a CTR stream, the two cipher blocks can be XOR'ed together to produce a XOR of the plaintexts. From there, the plaintext is recovered using analysis, such as searching for words. This makes unathenticated memory encryption, used in practice, insecure against someone who can edit the counter and trigger reuse.
But my understanding is that such analysis is enabled by the very low entropy of sample plaintexts - the usual examples are English text or bitmap images, which only use a small fraction of the block's information capacity.
Since txt files and bitmaps are relics at this time (easily found in OS files, though), could the attacker still recover the key from XORs of higher-entropy plaintexts in modern data formats?
Specifically to consider .docx, which is compressed with zip (weak compression), and lossy-compressed images or video (high entropy, but they include structure and headers, and can be useful even if severely damaged).
What if the nonce was reused many times, giving the attacker a much larger amount of information? I have a feeling that there might be some mathematical limit, e.g. best-case plaintext recovery requiring at least 1-(1-(entropy/Shannon_limit))^number_of_pairs>entropy/Shannon_limit.
But no idea if that holds, or if there are techniques to reconstruct plaintexts from XORs of general-case data, rather than specific kinds such as natural language.