What happens during an iPhone restore

Solution 1:

You are basically correct. Information about the APTicket can be found here, and SHSH information can be found here. And here is a slideshow from iH8sn0w from JailbreakCon in 2012 that describes everything else that you could ever want to know about the process. The JailbreakCon link has a list of all talks and links to their videos and/or slides (if publicly available) should you be hungry for even more information.

As far as actually how the nonce is generated, the bootloaders have been dumped, but they're proprietary and protected by copyright law, so publishing their contents is illegal. You can, however, dump them yourself, and investigate on your own.