Why is it good to split a CTR-mode counter into nonce and counter? When discussing the CTR mode of block ciphers, Wikipedia says the following:


  Simply adding or XORing the nonce and counter into a single value
  would completely break the security under a chosen-plaintext attack.


I don't understand the difference between the split nonce/counter design and simply using a random value and incrementing.  Why is using nonce +/⊕ counter insecure whereas nonce || counter is secure?

I don't see the difference between a split nonce/counter and nonce +/⊕ counter.  At first glance, isn't split nonce/counter mode the same as concatenating a bunch of 0 bits to the nonce and using nonce +/⊕ counter mode?

(By "+/⊕", I mean either addition or XOR, since it doesn't seem to matter which is used for this purpose.)
Suppose you do CTR mode as:


  $E(k,nonce+1) \oplus m_1$, $E(k,nonce+2) \oplus m_2$, $E(k,nonce+3) \oplus m_3$, etc.


The wikipedia page is talking about a non-random nonce, with a specific example of a packet counter. So suppose $nonce$ is a packet counter and in each packet you encrypt several blocks. You might end up with the following:

In packet #$p$:


  $E(k,p+1) \oplus m_1$, $E(k,p+2) \oplus m_2$, $E(k,p+3) \oplus m_3$, etc.


In packet # $p+1$:


  $E(k,(p+1)+1) \oplus m'_1$, $E(k,(p+1)+2) \oplus m'_2$, $E(k,(p+2)+1) \oplus m'_3$, etc.


The nonces are unique, but CPA security is broken. You have used $E(k,p+2)$ as a mask twice, and are leaking the value of $m_2 \oplus m'_1$.