What's the purpose of secret message numbers in CAESAR ciphers?

Question

The CAESAR call for submissions specifies that ciphers may accept as a parameter a secret message number. The requirements are that:

1. It must be possible to recover the plaintext and the secret message number from the ciphertext, associated data, public message number, and key;
2. Ciphers may impose single-use requirements on the secret message number, but can't otherwise assume any specific generation scheme (e.g., counter or random selection);
3. Ciphers must provide authenticity and confidentiality for the secret message number.

While this is quite clear about the requirements, I'm still at a loss at the purpose. What uses or features do such secret message numbers enable? Are there generic benefits to having such a message number, or is it something that individual ciphers would exploit for different ends?

Answers to the following older questions suggest that they may be used to provide some sort of nonce-reuse resistance or "hybrid encryption," but don't explain those scenarios in depth:

• Single-algorithm authenticated encryption
• What do associated data and message numbers mean?

And scanning through the third-round candidates' submissions doesn't shed a lot of light either—most of them don't support secret message numbers, and the one or two that did provide it as an optional feature

Answer 1

DJB answers this question on the crypto-competions mailing list.

In short, the idea is that using counter as a nonce can leak information that would be better not leaked in real world conditions where an attacker may not have a copy of every message exchanged (or even if they do if e.g. a timestamp is used as counter). However, using a counter also makes it much easier to reject replays without the protocol designer needing to include a separate counter.