Sorry :) My point is that surely the nonce value here *must* be equal to the block length because we don't offer any counter management schemes.

NIST also suggest non-monotonic counters based on a long period LFSR which I suppose we don't support at all?