Client generated random nonce:

    lowercase,

    36 char string,

    each nonce can be used only once within a timeframe of 150 seconds.