Why does TinyJAMBU-128 claim only 112-bit security? I am trying to understand the security level of TinyJAMBU-128.
As shown in Table 4.1 page 12 of this document, TinyJAMBU-128 claims 112-bit security. However, it has a 128-bit key. How have we lost 16 bits of key? What is the obvious attack that has $2^{112}$ time complexity?
I believe this is simply a statement of the intention to meet the submission requirements set out by NIST for lightweight ciphers.  Note that the paper linked in the question refers to &quot;security goals&quot;.
As per section 3.1:

An AEAD algorithm shall not specify key lengths that are smaller than 128 bits. Cryptanalytic attacks on the AEAD algorithm shall require at least ${2}^{112}$ computations on a classical computer in a single-key setting. If a key size larger than 128 bits is supported, it is recommended that at least one recommended parameter set has a key size of 256 bits, and that its resistance against cryptanalytical attacks is at least $2^{224}$ computations on a classical computer in a single-key setting.

Note that these are the final submission requirements from 2018.  It seems the figure for 192-bit is deduced from the requirements for 256 bit, or is perhaps referencing earlier requirements.