 Moreover, GCM is neither well-suited for use with very short tag-lengths nor very long messages.Ferguson and Saarinen independently described how an attacker can perform optimal attacks against GCM authentication, which meet the lower bound on its security.Ferguson showed that, if "n" denotes the total number of blocks in the encoding (the input to the GHASH function), then there is a method of constructing a targeted ciphertext forgery that is expected to succeed with a probability of approximately "n"⋅2−"t".