In the paper The Security and Performance of the GaloisCounter Mode(GCM) of Operation,it shows the AES GCM SECURITY in Corollary 1.
there are no distinguishing attacks against AES-N-GCM that work with distinguishing advantage greater than $A_{A E S-N}+q^{2} 2^{-116}-q 2^{-89.4}$
there are no forgery attacks against AES-N-GCM that work with forgery advantage greater than$A_{A E S-N}+q^{2} 2^{-116}-q 2^{-89.4}-q 2^{-128}$
But I can not get the same result (the right corollary) from the theorem 1 & 2 as the paper described when I plug in the value of parameters. Here are the Theorem 1 & 2:
I presented my calculating process below.
$A_{E} \geq A_{G C M}-q^{2} 2^{-129}\left(94^{2}+2 \times 2 \times 95\right)-q \times 95 \times 2^{-96}$ $A_{E} \geq A_{G C M}-q^{2} \times 9216 \times 2^{-129}-q \times 95 \times 2^{-96}$ $A_{E} \geq A_{G C M}-q^{2} 3^{2} \times 2^{-119}-q \times 2^{-89.4}$
I notice that my result has a $-q^{2} 3^{2} \times 2^{-119}$ item.However,the corollary in paper displays a $+q^{2} 2^{-116}$ .