Streaming mode of operation that is more resistant against nonce reuse Is it possible to create a streaming mode of operation where the reuse of a nonce does not destroy confidentiality?

In this question it would be allowed for the streaming mode to leak if ciphertexts are (partially) identical or not - like in CBC mode of operation. It is of course not permitted to introduce other secrets or random values other than the key and original nonce.

I've got the feeling that this is only possible by mixing in information from the plaintext, but that would make the cipher much less efficient.
For my answer I'll distinguish two cases: a) By "streaming" you mean "online" and b) by "streaming" you mean "can encrypt arbitrarily sized messages". See the CAESAR survey paper for the notions I use here.



There can be no fully nonce-misuse resistant online authenticated encryption scheme, i.e. a scheme where the only information leaked upon nonce reuse is whether two messages are identical. However, there's a weaker notion of nonce misuse resistance that allows the "longest common prefix of the messages" to be leaked. I think this notion may be sufficient to you.

The survey paper I linked above lists some candidate constructions for this property and may be more up-to-date than this answer (especially if the round three candidates are already in).



If you are willing to allow offline schemes (i.e. schemes that need at least some information about the complete message before being able to output cipher texts), then you're lucky. It is possible for those schemes to achieve the strong nonce misuse resistance. The most recent and most efficient example I've seen in this category (with full security proofs) being GCM-SIV by Gueron and Lindell.