2
$\begingroup$

What is the effect of the birthday bound on the security of AES-GCM, when a very large number of messages are encrypted?

I am looking for attacks that are useful in obtaining information about the plaintext and/or creating forgeries, not just distinguishers.

$\endgroup$