The nonce is now passed in as the prefix to the ciphertext, and is generated randomly in calls to Encrypt.