Beyond 2 c/2 Security in Sponge-Based Authenticated Encryption Modes

The Sponge function is known to achieve 2(c/2) security, where c is its capacity. This bound was carried over to keyed variants of the function, such as SpongeWrap, to achieve a min{2(c/2), 2(kappa)} security bound, with. the key length. Similarly, many CAESAR competition submissions are designed to comply with the classical 2(c/2) securi...More