What happens to NORX if the same (key, nonce, header data) triple is reused As I understand it, reusing a (key, nonce, header data) triple in NORX leaks


the XOR of the initial common prefix (but this is zero, so only its length is leaked)
the XOR of the first distinct blocks (which is usable by an attacker)


Is this all NORX leaks if misused?
It depends on the attack model. In certain (realistic!) attack models, such as the one used for the BEAST and related attacks on TLS, security breaks down further—it becomes possible to decrypt messages in a byte-by-byte fashion!

This is not specific to NORX; any online authenticated encryption scheme will be vulnerable to the CPSS attack if misused repeatedly, though supposedly "misuse-resistant" modes do not lose security instantly (unlike e.g. AES-GCM). Modes that resist this kind of misuse necessarily need to perform two passes over the message, rendering them offline (i.e., the entire message must be accessible during encryption).