Session Key + Nonce = Keystream?
Yes, the keystream is a function of the key and the nonce, in the mathematical sense (same key + nonce combination yields same keystream):
keystream = F(key, nonce)
F is the stream cipher's keystream generation function (often just called the stream cipher). Think of
F as the black box where all the cryptographic dark magic happens—each time you feed it a secret key and public nonce, it will produce very long output that looks random in practice to somebody who doesn't know the key, but which another party that knows the same secret key can recreate simply by using the same key + nonce combination.
The Keystream is now the part which is used to encrypt the plain text?
Yes, by XORing them together:
ciphertext = plaintext XOR keystream
Or, expanding the definition of
ciphertext = plaintext XOR F(key, nonce)
How is it possible to decrypt anything? Do I need a piece of plain text and an encrypted message from what I suggest this plain text is in there to then derive the keystream?
0 XOR x = x and
x XOR x = 0 for all
x, the previous equation implies this one:
plaintext = ciphertext XOR F(key, nonce)
So to decrypt the ciphertext, the recipient just needs to have the same key and nonce that were used to encrypt it. Think of
F, again, as a compact black box that reproduces the same keystream given the same key and nonce that were used to encrypt.
Does every single packet get a new Keystream for encryption or does the keystream renew after a complete new 4-way handshake?
Each packet in the same session is encrypted with the same key, but with a different nonce; this means that in correct operation, a new keystream is used for each packet. An incrementing packet counter is used for the nonces. The attack consists in tricking implementations to reset the packet counter to its initial value without resetting the key. This causes the victim to encrypt multiple messages with the same key and nonce, and thus with the same keystream.