Nonce-misuse resistance seems to have two standard notions:
The stronger notion: this reveals nothing unless the exact same nonce is used to encrypt the exact same message twice. In this case, the only information that is revealed is that the same message was encrypted twice. This can be used to notice that a message is resent.
- AES-GCM-SIV has known to have the strong nonce-misuse resistance.
The weaker notion uses some prefix of the message to achieve nonce-misuse resistance. Nonce misuse occurs if a nonce-key-message-prefix triple is reused. A crib-dragging can be used to reveal the rest of the messages.
- Is there any encryption scheme that has weak nonce-misuse resistance?
- Is there any other encryption scheme that has strong nonce-misuse resistance other than SIV mode?
Note: The weak notion is not to be confused with another weak notion of nonce-misuse resistance which allows leakage of the length of the common prefix for two messages encrypted under the same key-nonce pair.