A toy reused nonce makes the same keystream appear twice.

highlighted = computed this step

Both records use the same nonce

Nonce A is 0x000000000001, and nonce B is the same pinned bytes.

nonce A=0x000000000001\text{nonce A}=0x000000000001
Same nonceBoth toy messages carry the same nonce bytes.Nonce A48 bits / 6 bytes0x000000000001byte 0byte 1byte 2byte 300000000000000000000000000000000byte 4byte 50000000000000001byte-00x00byte-10x00byte-20x00byte-30x00byte-40x00byte-50x01Nonce B48 bits / 6 bytes0x000000000001byte 0byte 1byte 2byte 300000000000000000000000000000000byte 4byte 50000000000000001byte-00x00byte-10x00byte-20x00byte-30x00byte-40x00byte-50x01Toy keystream48 bits / 6 bytes0x0f1e2d3c4b5abyte 0byte 1byte 2byte 300001111000111100010110100111100byte 4byte 50100101101011010byte-00x0fbyte-10x1ebyte-20x2dbyte-30x3cbyte-40x4bbyte-50x5a

The nonce bytes match

The helper requires nonce A and nonce B to match before it models a reused keystream.

nonce reused=1\text{nonce reused}=1
Same nonceBoth toy messages carry the same nonce bytes.Nonce A48 bits / 6 bytes0x000000000001byte 0byte 1byte 2byte 300000000000000000000000000000000byte 4byte 50000000000000001byte-00x00byte-10x00byte-20x00byte-30x00byte-40x00byte-50x01Nonce B48 bits / 6 bytes0x000000000001byte 0byte 1byte 2byte 300000000000000000000000000000000byte 4byte 50000000000000001byte-00x00byte-10x00byte-20x00byte-30x00byte-40x00byte-50x01Toy keystream48 bits / 6 bytes0x0f1e2d3c4b5abyte 0byte 1byte 2byte 300001111000111100010110100111100byte 4byte 50100101101011010byte-00x0fbyte-10x1ebyte-20x2dbyte-30x3cbyte-40x4bbyte-50x5a

The toy keystream is reused

With the same toy nonce, this example reuses keystream 0x0f1e2d3c4b5a.

keystream=0x0f1e2d3c4b5a\text{keystream}=0x0f1e2d3c4b5a
Same nonceBoth toy messages carry the same nonce bytes.Nonce A48 bits / 6 bytes0x000000000001byte 0byte 1byte 2byte 300000000000000000000000000000000byte 4byte 50000000000000001byte-00x00byte-10x00byte-20x00byte-30x00byte-40x00byte-50x01Nonce B48 bits / 6 bytes0x000000000001byte 0byte 1byte 2byte 300000000000000000000000000000000byte 4byte 50000000000000001byte-00x00byte-10x00byte-20x00byte-30x00byte-40x00byte-50x01Toy keystream48 bits / 6 bytes0x0f1e2d3c4b5abyte 0byte 1byte 2byte 300001111000111100010110100111100byte 4byte 50100101101011010byte-00x0fbyte-10x1ebyte-20x2dbyte-30x3cbyte-40x4bbyte-50x5a

Summary

The problem starts before any clever math: the same nonce leads this toy to the same keystream.

byte length=6\text{byte length}=6
Same nonceBoth toy messages carry the same nonce bytes.Nonce A48 bits / 6 bytes0x000000000001byte 0byte 1byte 2byte 300000000000000000000000000000000byte 4byte 50000000000000001byte-00x00byte-10x00byte-20x00byte-30x00byte-40x00byte-50x01Nonce B48 bits / 6 bytes0x000000000001byte 0byte 1byte 2byte 300000000000000000000000000000000byte 4byte 50000000000000001byte-00x00byte-10x00byte-20x00byte-30x00byte-40x00byte-50x01Toy keystream48 bits / 6 bytes0x0f1e2d3c4b5abyte 0byte 1byte 2byte 300001111000111100010110100111100byte 4byte 50100101101011010byte-00x0fbyte-10x1ebyte-20x2dbyte-30x3cbyte-40x4bbyte-50x5a