nonce
random · unique per message · 24 bytes (192-bit)
aad (authenticated, not encrypted)
the server could read this · cannot modify without breaking the
tag
tag
Poly1305 MAC · proves integrity of ciphertext + AAD
server saw
opaque base64 · server cannot read the payload
resends captured blob · receiving client will detect replay via
sequence number