What is the effect of the birthday bound on the security of AES-GCM, when a very large number of messages are encrypted?
I am looking for attacks that are useful in obtaining information about the plaintext and/or creating forgeries, not just distinguishers.
