code: public byte[] nonce() {
      final byte[] nonce = new byte[NONCE_SIZE];
      final SecureRandom random = new SecureRandom();
      random.nextBytes(nonce);
      return nonce;
    }
docs: Generates a random nonce.
  
  <p><b>N.B.:</b> Use of this method is probably fine, but because an entropy-exhausted or
  compromised {@link SecureRandom} provider might generate duplicate nonces (which would allow an
  attacker to potentially decrypt and even forge messages), {@link #nonce(byte[])} is recommended
  instead.
  
  @return a 24-byte nonce