I'm a little bit confused regarding the keystream. When installing the same session key again the nonce will be reset and start again.

- Session Key + Nonce = Keystream?

- The Keystream is now the part which is used to encrypt the plain text?

How is it possible to decrypt anything? Do I need a piece of plain text and an encrypted message from what I suggest this plain text is in there to then derive the keystream?

Does every single packet get a new Keystream for encryption or does the keystream renew after a complete new 4-way handshake?