How is the re-encryption done in Path ORAM?
Client holds a secret key, which is used to encrypt/decrypt all blocks.  Nonce is not used as a key but randomness to make sure that all the blocks, no matter updated or not, will look fresh.