Exercise 3: Reusing a Stream Cipher Keystream — Possible Solution
====================================================================

Because the SAME key and SAME nonce were used for both messages, the
stream cipher generates the EXACT SAME keystream both times -- the
keystream depends only on the key and nonce, not on the message
content.

Let K be that (identical) keystream, and let P1 and P2 be the two
plaintexts. The two ciphertexts are:

    C1 = P1 XOR K
    C2 = P2 XOR K

An attacker who has both C1 and C2 can XOR the two ciphertexts
together directly:

    C1 XOR C2 = (P1 XOR K) XOR (P2 XOR K)
              = P1 XOR P2 XOR K XOR K
              = P1 XOR P2                (K XOR K cancels to all zeros)

The keystream K completely CANCELS OUT, leaving the attacker with
P1 XOR P2 -- the XOR of the two original plaintexts, with no
knowledge of the key required at all.

From there, this is a direct extension of Chapter 4's crib-dragging
technique: if the attacker can guess or already knows any part of
EITHER plaintext (using the same kind of predictable-content reasoning
Chapter 4 used for Enigma cribs -- routine phrasing, known headers,
common words), XORing that guessed fragment against the corresponding
part of P1 XOR P2 reveals the corresponding fragment of the OTHER
plaintext directly. Recovering fragments of one plaintext progressively
reveals more of the other, and the two can often be fully recovered
this way.

Why this happens: a stream cipher's entire security depends on the
keystream never repeating (per this chapter's "Vigenère, done
properly" comparison) -- reusing the same key+nonce pair regenerates
the identical keystream, which reintroduces exactly the repeating-key
weakness Vigenère had in Chapter 2, just now expressed as a
two-time-use failure rather than a short repeating word.

WHY THIS WORKS AS AN ANSWER
------------------------------
The XOR-cancellation algebra shown above is the precise mechanism
behind this chapter's "stream cipher is Vigenère, done properly"
tip-box -- "done properly" specifically means the keystream must never
repeat, and this exercise shows exactly what breaks the moment that
condition is violated even once. The crib-dragging connection back to
Chapter 4 is deliberate: once the keystream cancels out, recovering
the two plaintexts becomes a known-fragment-guessing problem
structurally identical to Enigma cryptanalysis, not a fundamentally
new attack.