Why does NIST want 112-bit security from 128-bit key size for lightweight cryptography? In NIST's Submission Requirements and Evaluation Criteria for the Lightweight Cryptography Standardization Process document it is stated that:

3.1 AEAD (Authenticated Encryption with Associated Data) Requirements
An AEAD algorithm shall not specify key lengths that are smaller than 128 bits. Cryptanalytic
attacks on the AEAD algorithm shall require at least $\mathbf{2^{112}}$ computations on a classical computer in a single-key setting. If a key size larger than 128 bits is supported, it is recommended that at least one recommended parameter set has a key size of 256 bits, and that its resistance against cryptanalytical attacks is at least $\mathbf{2^{224}}$ computations on a classical computer in a single-key setting (The bolds are mine!)


Why does the NIST require 112-bit security from at least a 128-bit key on AEAD?
From the security perspective, they should require 128-security. Any attack that reduces 128-bit security can lead to more attacks. What is the rationale behind this requirement?

And similarly for the hash functions;

3.2 Hash Function Requirements
Cryptanalytic attacks on the hash function shall require at least $\mathbf{2^{112}}$ computations on a classical computer. The hash function shall not specify output sizes that are smaller than 256 bits. (The bolds are mine!)

From the values, we can hint that they consider the collision resistance. Similar questions;

Why does NIST require 112-bit security from 256-bit hash functions?
What is the rationale behind this requirement?
From the security perspective, they should require 128-security.

Why?
NIST has a requirement for a minimum security strength of 112 bits for all things cryptographic, at least for the present.  You see it everywhere in their documents.  For example, in Transitioning the Use of Cryptographic Algorithms and
Key Lengths it says

For the Federal Government, a security strength of at least 112 bits
is required at this time for applying cryptographic protection (e.g.,
for encrypting or signing data). Note that prior to 2014, a security
strength of at least 80 bits was required for applying these
protections, and the transitions in this document reflect this change
to a required security strength of at least 112 bits.

Apparently, the cryptographers at NIST believe that 112 bits of security is sufficient for now.  128 bits is coming though.

SP 800-57, Part 1 includes a transition to a security strength of 128
bits in 2030; in some cases, the transition would be addressed by an
increase in key sizes.

Do note that this is their minimum requirement for the US Federal government, your requirements may be different.