- A nonce N of 15-L octets. Within the scope of any encryption key K, the nonce value MUST be unique. That is, the set of nonce values used with any given key MUST NOT contain any duplicate values. Using the same nonce for two different messages encrypted with the same key destroys the security properties of this mode.
If the nonce values must not contain any duplicate elements doesn't this imply that they should be known to all parties in a transaction. For instance if a client wishes to authenticate and communicate with a server, shouldn't they both have a predefined set of nonces. If not, how should they be exchanged, given that the context only allows for CTR-AES encrypted messages?