we need a bit nonce so that you are guaranteed to have a large integer here  you do not want implementations to not care what they put in here and end up with ridiculously small values this is a security api and need to clearly define what is needed 