The Security of AES-N-GCM

Question

In the paper The Security and Performance of the GaloisCounter Mode(GCM) of Operation,it shows the AES GCM SECURITY in Corollary 1.

there are no distinguishing attacks against AES-N-GCM that work with distinguishing advantage greater than $A_{A E S-N}+q^{2} 2^{-116}-q 2^{-89.4}$

there are no forgery attacks against AES-N-GCM that work with forgery advantage greater than$A_{A E S-N}+q^{2} 2^{-116}-q 2^{-89.4}-q 2^{-128}$

But I can not get the same result (the right corollary) from the theorem 1 & 2 as the paper described when I plug in the value of parameters. Here are the Theorem 1 & 2:

I presented my calculating process below.

$A_{E} \geq A_{G C M}-q^{2} 2^{-129}\left(94^{2}+2 \times 2 \times 95\right)-q \times 95 \times 2^{-96}$ $A_{E} \geq A_{G C M}-q^{2} \times 9216 \times 2^{-129}-q \times 95 \times 2^{-96}$ $A_{E} \geq A_{G C M}-q^{2} 3^{2} \times 2^{-119}-q \times 2^{-89.4}$

I notice that my result has a $-q^{2} 3^{2} \times 2^{-119}$ item.However,the corollary in paper displays a $+q^{2} 2^{-116}$ .

Answer 1

You appear to have computed things correctly. However, you have quoted their Corollary 1 wrong: you've included an extra $-q^22^{-128}$ term in the confidentiality part (don't know if that was what confused you though). To get their $2^{-89.4}$ instead of your $2^{-89.5}$ simply include more decimals of $\log_2(95)$.