# AES-GCM cipher - Nonce vs IV

I am using a Python library called PyCryptodome, which offers the following API for AES-GCM ciphers:

As you see, IV is not applicable for GCM ciphers.

There are some C++ libraries that expect the user to specify the IV rather than the nonce.

Let's say that I get a message encrypted with a C++ library that uses a 16 bit IV. Later on, I want to decode this message using a Python library. Given that I know the key and the IV that was used, will I be able to properly decipher the message when I specify the nonce to be the IV?

• @ErikAronesty If you use a nonce other than 96 bits, GCM derives an initial block pseudorandomly from the nonce—so even if you choose a (say) 64-bit nonce sequentially you can get a nonce collision long before $2^{64}$ messages. The story is actually a little more complicated, and the originally claimed security reduction was wrong because the designers of GCM made a mistake in studying how non-96-bit nonces work. See crypto.stackexchange.com/a/67367 for some references and further information about GCM. I recommend you always use 96-bit sequential nonces with AES-GCM. – Squeamish Ossifrage Sep 19 '19 at 15:15