Cryptography Advice? (#L120)

currently playing around with X25519/chacha20 (and its AEAD counterpart chacha20poly1305) to do some PGP-esque encryption stuffs.

based on my understanding of stream ciphers, "nonce reuse" refers more specifically to "nonce reuse with a given key, for different plaintexts."

basically the thing that i'm trying to evaluate is whether there is any risk to "reusing" a single nonce with a bunch of keys that are guaranteed to be random.

the process for encryption is as follows:

1. Generate one-time and ephemeral components

    - nonce

    - one-time content key

    - ephemeral private key

    - one-time public key

2. Sign plaintext to generate content signature

3. Encrypt plaintext and content signature with one-time content key

4. Encrypt one-time content key for all recipients

    - Generate shared secret with recipient public key and ephemeral private key
    
    - Encrypt one-time content key with shared secret

in the current setup the "content key" (think PGP session key) is always randomly generated, and the Diffie-Hellman shared secrets—used to encrypt the "content key" for each recipient—are created with an ephemeral/throw-away private key that's also randomly generated (and if you have a duplicated public key in your recipient set, it's still same-key-for-same-nonce-for-same-plaintext so no violation).

additionally, if there was somehow an overlap on a recipient's DH shared secret and the content key (statistically very low likelihood) i'm not sure that there is any additional vulnerability, or way to analyze without having already either gotten the content key or the shared secret, and in either of those cases you're already in.

NOTE: this whole thing is mostly just about saving storage space; ideally just wouldn't have to store an additional 24 bytes per recipient. with benchmarking, the time overhead of generating a nonce for each recipient is negligible.