diff --git a/exam/ex.tex b/exam/ex.tex
index 0742647..52c7295 100644
--- a/exam/ex.tex
+++ b/exam/ex.tex
@@ -137,7 +137,13 @@
       number of evaluations an attacker has to make to obtain a repeated nonce
       is $2^{96/2} = 2^{48}$.
 
-    \item \TODO
+    \item After $2^b = 2^{62}$ forgery attempts, the attacker has exhausted the
+      keyspace of the tag because the tag $T$ is of size $\unit[62]{bits}$. The
+      distinguisher checks continuously if the current tag matches the
+      ciphertext. If it does not, the tag is incremented by one until $2^{62}$
+      queries have been made. Eventually, the distinguisher will get the valid
+      tag and is then able to identify if it is in the real world or in the
+      ideal world.
 
     \item \TODO