 Appendix C in NIST SP 800-38D provides guidance for these constraints (for example, if and the maximal packet size is 210 bytes, the authentication decryption function should be invoked no more than 211 times; if and the maximal packet size is 215 bytes, the authentication decryption function should be invoked no more than 232 times).Like with any message authentication code, if the adversary chooses a "t"-bit tag at random, it is expected to be correct for given data with probability measure 2−"t".With GCM, however, an adversary can increase their likelihood of success by choosing tags with n words – the total length of the ciphertext plus any additional authenticated data (AAD) – with probability measure 2−"t" by a factor of n. Although, one must bear in mind that these optimal tags are still dominated by the algorithm's survival measure for arbitrarily large "t".