The CAESAR call for submissions specifies that ciphers may accept as a parameter a secret message number. The requirements are that:
- It must be possible to recover the plaintext and the secret message number from the ciphertext, associated data, public message number, and key;
- Ciphers may impose single-use requirements on the secret message number, but can't otherwise assume any specific generation scheme (e.g., counter or random selection);
- Ciphers must provide authenticity and confidentiality for the secret message number.
While this is quite clear about the requirements, I'm still at a loss at the purpose. What uses or features do such secret message numbers enable? Are there generic benefits to having such a message number, or is it something that individual ciphers would exploit for different ends?
Answers to the following older questions suggest that they may be used to provide some sort of nonce-reuse resistance or "hybrid encryption," but don't explain those scenarios in depth:
And scanning through the third-round candidates' submissions doesn't shed a lot of light either—most of them don't support secret message numbers, and the one or two that did provide it as an optional feature