nonce
termcryptographysecurity
Stands for: number used once
A number used once, included in a protocol so the same message cannot be replayed.
A nonce guarantees freshness: because it never repeats, a captured request cannot be resent to fool the receiver. It is distinct from an IV and from a salt, though all three inject uniqueness; the nonce's specific job is defeating replay.
A nonce is a value used exactly once, and the entire security of several systems rests on that word. It is not required to be secret and often travels in the clear; what it must be is unrepeated within its context, which makes it a very different thing from a key.
Its main job is defeating replay. If an attacker can capture a valid message and send it again later to the same effect, the system is broken regardless of how strong the cryptography is, so the recipient tracks which nonces it has seen and rejects repeats. OIDC uses one to bind an ID token to the specific request that asked for it, which is why a token replayed from another session fails validation.
The catastrophic version of getting this wrong is nonce reuse in encryption. Repeating one under the same key in a counter-mode cipher does not weaken the encryption a little, it can reveal the relationship between two plaintexts outright. This is why nonce-misuse-resistant modes were designed and why random nonces of adequate length are preferred to counters that might restart when a device reboots.
Also known as: number used once, cryptographic nonce