 More precisely, this work describes a particular way of forging a GCM message, given a valid GCM message, that works with probability of about for messages that are bits long.However, this work does not show a more effective attack than was previously known; the success probability in observation 1 of this paper matches that of lemma 2 from the INDOCRYPT 2004 analysis (setting and ).Saarinen also described a GCM variant Sophie Germain Counter Mode (SGCM) based on Sophie Germain primes.