a 128-bit block cipher
is how big the auth tag will be (even values between 4 and 16 are accepted)
length of L parameter. The total message length must be less than 2**L bytes, and the nonce is 15-L bytes.
See Implementation