Picking a nonce in the context of CCM (CTR with CBC-MAC) mode After having read the RFC 3610: Counter with CBC-MAC (CCM) and the Wikipedia article on CTR mode, I'm not sure how a nonce should be picked.  The RFC says:


  
  A nonce N of 15-L octets.  Within the scope of any encryption key
     K, the nonce value MUST be unique.  That is, the set of nonce
     values used with any given key MUST NOT contain any duplicate
     values.  Using the same nonce for two different messages
     encrypted with the same key destroys the security properties of
     this mode.
  


If the nonce values must not contain any duplicate elements doesn't this imply that they should be known to all parties in a transaction. For instance if a client wishes to authenticate and communicate with a server, shouldn't they both have a predefined set of nonces. If not, how should they be exchanged, given that the context only allows for CTR-AES encrypted messages?
Yes, if the client and the server use the same key to encrypt their messages (instead of having separate keys for client-to-server and server-to-client communication), then you need to ensure that they cannot ever use the same nonce.

One way to do that would be to, say, let the client use only even nonce values, and let the server use only odd nonce values.  Of course, other ways of partitioning the nonce space are equally possible.