Beyond Conventional Security in Sponge-Based Authenticated Encryption Modes KU Leuven
© 2018 The Author(s) The Sponge function is known to achieve (Formula presented.) security, where c is its capacity. This bound was carried over to its keyed variants, such as SpongeWrap, to achieve a (Formula presented.) security bound, with (Formula presented.) the key length. Similarly, many CAESAR competition submissions were designed to comply with the classical (Formula presented.) security bound. We show that Sponge-based constructions ...