# The Security of AES-N-GCM

In the paper The Security and Performance of the GaloisCounter Mode(GCM) of Operation,it shows the AES GCM SECURITY in Corollary 1.

there are no distinguishing attacks against AES-N-GCM that work with distinguishing advantage greater than $$A_{A E S-N}+q^{2} 2^{-116}-q 2^{-89.4}$$

there are no forgery attacks against AES-N-GCM that work with forgery advantage greater than$$A_{A E S-N}+q^{2} 2^{-116}-q 2^{-89.4}-q 2^{-128}$$

But I can not get the same result (the right corollary) from the theorem 1 & 2 as the paper described when I plug in the value of parameters. Here are the Theorem 1 & 2:

I presented my calculating process below.

$$A_{E} \geq A_{G C M}-q^{2} 2^{-129}\left(94^{2}+2 \times 2 \times 95\right)-q \times 95 \times 2^{-96}$$ $$A_{E} \geq A_{G C M}-q^{2} \times 9216 \times 2^{-129}-q \times 95 \times 2^{-96}$$ $$A_{E} \geq A_{G C M}-q^{2} 3^{2} \times 2^{-119}-q \times 2^{-89.4}$$

I notice that my result has a $$-q^{2} 3^{2} \times 2^{-119}$$ item.However,the corollary in paper displays a $$+q^{2} 2^{-116}$$ .

• Corollary 1 just plugs in some concrete values into the formulae of theorems 1 and 2. What are you confused about? Did you get a different formulae when you inserted the values (128 bit block size, 1500 byte plaintexts)? – poncho Jun 29 '20 at 12:13
• @poncho Thanks for quick response, I have no idea why I just got the email message ...And yes,I plug in values ( w=128 , l(lv)=96 , t = 96 ,l =12000 ) and it doesn' t equal the Corollay 1. Could you please give a full calculation process about that? maybe I don't understand the paper well enough, your answer could be of great help.Thanks. – Pete Jul 3 '20 at 1:22
• @poncho I have no idea how to get the corollay 1 .So please help me if i's convenient.Thanks a lot. – Pete Jul 4 '20 at 3:46
• I've not rewarded the bounty yet as the difference between $2^{-119}$ and $2^{-116}$ isn't explained, although a factor of $2^3 = 8$ difference seems rather minimal in the grand scheme of things. – Maarten Bodewes Jul 9 '20 at 11:46

You appear to have computed things correctly. However, you have quoted their Corollary 1 wrong: you've included an extra $$-q^22^{-128}$$ term in the confidentiality part (don't know if that was what confused you though). To get their $$2^{-89.4}$$ instead of your $$2^{-89.5}$$ simply include more decimals of $$\log_2(95)$$.