[MLS] Reuse guard in Framing

[Tijana Klimovic <[e-mail]>]

Hello,

I have a question regarding the reuse guard used in the framing. The
specification motivates its use in the following way:

"Before use in the encryption operation, the nonce is XORed with a fresh
random value to guard against reuse. Because the key schedule generates
nonces deterministically, a client must keep a persistent state as to where
in the key schedule it is; if this persistent state is lost or corrupted, a
client might reuse a generation that has already been used, causing reuse
of a key/nonce pair."

When would losing one's state be a realisitic possibility?

Many thanks.
Tijana