A nonce is a "number used once." The whole security of several widely deployed encryption and signature schemes rests on that single word — once. Break the rule, even by accident, even one time, and you can hand an attacker your message contents, your forgery key, or in the worst case your private signing key. This is the bug that has sunk WEP, a game console, and more than one TLS library.

Most cryptographic failures are gradual: a cipher weakens, a key gets a little too short for comfort, an attack drops from impractical to merely expensive. Nonce reuse is not like that. It's a cliff.…