CCM authenticity bound Can someone help me understanding the CCM authenticity bound by Phillip Rogaway?
i-e Success probability &lt; $q_{\text{dec}}/2^\tau + \sigma/2^b$.

$\tau$ is tag length, where as $b$ is block length. $q_{\text{dec}}$ is the number of forgery attempts, I can not get whats "$\sigma$" is?

Also If i am not looking for forgery attempts but looking for the channel errors that cause invalid message to go through CBC MAC. Then for that case $q_{\text{dec}}=1$. Am I right? 
And I am attempting to send 500MB of data? So what will be the number of un-authenticated messages that go through CBC MAC because of channel errors.
If you mean this paper by Rogaway, "Evaluation of Some Blockcipher Modes of Operation" (PDF, relevant page is 120) then it very clearly documents everything.


$q_{\text{dec}}$ is the total amount of decryption queries the adversary asks. If you only accept one decryption query before using different keys, this can be approximated by $1$.
$\sigma$ is the total number of block cipher calls the mode would make on the adversary's sequence of queries. So if all adversarial queries (encryption and decryption ones) together require 4 block cipher calls to process, then $\sigma=4$. For 500 MByte of Data (in the single query) this would imply $\sigma\approx 2^{26}$


Also note that the bound stated in the paper (note the additional square on the $\sigma$) is $$\leq \frac{q_{\text{dec}}}{2^\tau}+\frac{\sigma^2}{2^b}$$

Plugging in the above values yields an advantage of $\leq 1/2^\tau+2^{52}/2^b$ which bounds the success probability of any adversary. Now random noise usually isn't exactly a smart adversary so the probability of a (successful) forgery from random noise is even much lower.



So let's clarify on what a "block cipher call" actually is. Modes of operation like CCM are built on block-ciphers which get modelled as functions $C=E_K(P)$ for some plaintext $P$, some key $K$ and the corresponding ciphertext $C$ where $P$ and $C$ are the same, fixed size. One computation of $C$ from $K,P$ or of $P$ from $K,C$ is called one block cipher call (because in the implementation you call the block cipher function for this). Now for CCM mode, which I will skip describing here, you end up with about 2 block cipher calls per data block (one for privacy, one for authenticity), yielding the aforementioned $2^{26}\approx 2\cdot 500\cdot 10^6/16$.