Introduction: I've tried to find how reusing one-time key compromises itself but only found information that it breaks the encryption entirely, it is written everywhere. But since no methods to reuse or restore the key were specified I don't quite get how it can be done, even with plaintext and tag given.
Problem: we have several messages and its tags, encrypted with pure Poly1305 with the same key (generated using python's
chacha20poly1305, implementation code) without AES and ChaCha, as it seems from the code and according to the specification.
The inputs to Poly1305 are: A 256-bit one-time key; An arbitrary length message
I want to reuse Poly1305 key to sign custom message and therefore forge it. What should I do to reuse the same key without knowing it on my custom message or, if possible, find the key?
Example, you've got the following data, the same key is used 3 times (data in hex : tag in hex):
Data: e8962f8dada53f589eada744bf3f9bb298be47ebd3416a59a13a709d1bf6fb4d Tag: 825f51bb7b0f05990f03998c63a51f08 Data: 6e05652fe6a6985c1fed6604f95b133fe7a4a9f95313a8ad15d995195528efad Tag: 53cc694570e89ec66350b4d7877ea58a Data: 46a683f0a164bf6e19ee0b05f4c65f1f7b1d6ec454fe0e79ec4debfb22da36c1 Tag: cba1048b9ee15929a16f0cfe5f4547b1