Reusing a nonce cancels the key
Two messages under the same key and nonce share a keystream. XOR the ciphertexts and the key disappears; a guessed word reveals the rest.
Stream ciphers and CTR-mode AEADs XOR the message with a keystream. If two messages share a key and nonce, they share the keystream, and C₁ ⊕ C₂ = P₁ ⊕ P₂. No key needed. Guess a word in one message (a crib) and slide it along to read the other.
keystream (same nonce)19 3e 3a b5 1f 37 d0 bf 39 b8 ee b4 d3 3c b8 5f 8a de 7d 3f bf de d8 a2 1c 49 ea 8e e1 74 a6
C₁ = P₁ ⊕ KS78 4a 4e d4 7c 5c f0 de 4d 98 8a d5 a4 52 94 7f e8 ac 14 51 d8 fe ac ca 79 69 81 eb 98 07
C₂ = P₂ ⊕ KS74 5b 5f c1 3f 5a b5 9f 57 dd 8f c6 f3 48 d0 3a aa b1 11 5b 9f bc aa cb 78 2e 8f ae 8f 1b d1
C₁ ⊕ C₂0c 11 11 15 43 06 45 41 1a 45 05 13 57 1a 44 45 42 1d 05 0a 47 42 06 01 01 47 0e 45 17 1c
P₁ ⊕ P₂0c 11 11 15 43 06 45 41 1a 45 05 13 57 1a 44 45 42 1d 05 0a 47 42 06 01 01 47 0e 45 17 1c
Offset → crib ⊕ (C₁ ⊕ C₂). Green rows decode to readable text: the other message at that position.
00"xyt5"
01"eypc"
02"e}&&"
03"a+ce"
04"7n a"
05"r-$:"
06"1)·e"
07"5r %"
08"n-`3"
09"1mvw"
10"q{2:"
11"g?·d"
12"#r!e"
13"n, b"
14"0-'="
15"1*x%"
16"6u`*"
17"imog"
18"qb"b"
19"~/'&"
20"3*c!"
21"6nd!"
22"ridg"
23"ui"."
24"u/ke"
25"3f 7"
26"z-r<"
What to notice
- C₁ ⊕ C₂ equals P₁ ⊕ P₂ exactly. The attacker never needs the key.
- Sliding a guessed word (a crib) along the XOR reveals the other message wherever the guess is right.
- With AES-GCM a repeated nonce is worse still: it also leaks the authentication key. Use random 96-bit nonces with a limit per key, a counter, or a misuse-resistant mode such as AES-GCM-SIV.