I understand that when using CTR mode it is usually secure to append or prepend the nonce to the resulting ciphertext, whether the nonce is before or after the ciphertext being unimportant.
However, I am making another home-brew protocol (the bad thing that always happens from time to time), which led to the following scenario:
I chose XChaCha20Poly1305, the best AEAD primitive I could get my hands on, as the encryption primitive. I must give up the actual user control of the encryption key, and the nonce cannot be reliably stored persistently, so I chose to generate the nonce randomly. The resulting ciphertext will then be fed into another deterministic encrypter, say AES-CBC with a constant key (burnt into the chip and cannot be changed in the device's lifetime) and zero IV, over which I have completely no control. The final result will then be sent over the wire.
Does the sequence in which the ciphertext is formatted matter? I have no idea whether the device's RNG is broken or not, nor can I choose where to place the authentication tag in relation to the ciphertext.
If it is $$ nonce || Enc(key, plaintext) || tag $$ then in case of a RNG failure, the security is undermined; and if the extra encrypter is broken, the system fails completely. But if it is $$ Enc(key, plaintext) || tag || nonce $$ then the extra encrypter might provide a bit of security or even make most security claims hold, even in case of a RNG failure.
Many limitations are involved here, and this might be complicated question, but I hope someone can shed some light on this question for me.