Add solution for 2g

exam/ex.tex

@@ -137,7 +137,13 @@
       number of evaluations an attacker has to make to obtain a repeated nonce
       is $2^{96/2} = 2^{48}$.
 
-    \item \TODO
+    \item After $2^b = 2^{62}$ forgery attempts, the attacker has exhausted the
+      keyspace of the tag because the tag $T$ is of size $\unit[62]{bits}$. The
+      distinguisher checks continuously if the current tag matches the
+      ciphertext. If it does not, the tag is incremented by one until $2^{62}$
+      queries have been made. Eventually, the distinguisher will get the valid
+      tag and is then able to identify if it is in the real world or in the
+      ideal world.
 
     \item \TODO