Depending on if the key may be reused having a non-zero nonce may be a good idea too...

---

And I just realised who I am replying too, off course you know this.

I was being a bit facetious in discriminating between "IV" and "nonce"... they're almost two sides of the same coin.

And don't overflow.

If you need to send more than 2^68 bytes of data, you've got bigger problems than your crypto breaking.

You're assuming a correct implementation with a 64-bit counter, though.

Yes. I'm also assuming people have correct implementations of AES.

I have never exploited an incorrect implementation of an AES core in a real application, but have exploited "broken" counters.