Ascon (cipher)

Ascon is a family of

NIST had announced its decision on February 7, 2023[3] with the following intermediate steps that would lead to the eventual standardization:^[2]

• Publication of NIST IR 8454 describing the process of evaluation and selection that was used;
• Preparation of a new draft for public comments;
• Public workshop to be held on June 21-22, 2023.

Design

The design is based on a

• Ascon-128 and Ascon-128a authenticated ciphers;
• Ascon-Hash cryptographic hash;
• Ascon-Xof extendable-output function;
• Ascon-80pq cipher with an "increased" 160-bit key.

The main components have been borrowed from other designs:^[4]

• substitution layer utilizes a modified
  Keccak
  ;
• permutation layer functions are similar to the ${\displaystyle \Sigma }$ of SHA-2.

Parameterization

The ciphers are parameterizable by the

In the CAESAR submission, two sets of parameters were recommended:[6]

Padding

The data in both A and P is padded with a single bit with the value of 1 and a number of zeros to the nearest multiple of r bits. As an exception, if A is an empty string, there is no padding at all.^[7]

State

The state consists of 320 bits, so the capacity ${\displaystyle c=320-r}$.^[8] The state is initialized by an initialization vector IV (constant for each cipher type, e.g., hex 80400c0600000000 for Ascon-128) concatenated with K and N.^[9]

Transformation

The initial state is transformed by applying a times the transformation function p (${\displaystyle p^{a}}$). On encryption, each word of A || P is XORed into the state and the p is applied b times (${\displaystyle p^{b}}$). The ciphertext C is contained in the first r bits of the result of the XOR. Decryption is near-identical to encryption.^[8] The final stage that produces the tag T consists of another application of ${\displaystyle p^{a}}$; the special values are XORed into the last c bits after the initialization, the end of A, and before the finalization.^[7]

Transformation p consists of three layers:

• ${\displaystyle p_{C}}$, XORing the
  round constants
  ;
• ${\displaystyle p_{S}}$, application of 5-bit S-boxes;
• ${\displaystyle p_{L}}$, application of
  linear diffusion
  .

Test vectors

Hash values of an empty string (i.e., a zero-length input text) for both the XOF and non-XOF variants.^[10]

Ascon-Hash("")
0x 7346bc14f036e87ae03d0997913088f5f68411434b3cf8b54fa796a80d251f91
Ascon-HashA("")
0x aecd027026d0675f9de7a8ad8ccf512db64b1edcf0b20c388a0c7cc617aaa2c4
Ascon-Xof("", 32)
0x 5d4cbde6350ea4c174bd65b5b332f8408f99740b81aa02735eaefbcf0ba0339e
Ascon-XofA("", 32)
0x 7c10dffd6bb03be262d72fbe1b0f530013c6c4eadaabde278d6f29d579e3908d

Even a small change in the message will (with overwhelming probability) result in a different hash, due to the avalanche effect.

Ascon-Hash("The quick brown fox jumps over the lazy dog")
0x 3375fb43372c49cbd48ac5bb6774e7cf5702f537b2cf854628edae1bd280059e
Ascon-Hash("The quick brown fox jumps over the lazy dog.")
0x c9744340ed476ac235dd979d12f5010a7523146ee90b57ccc4faeb864efcd048

See also

• Speck - An earlier lightweight cipher family released by the U.S. National Security Agency

References

Sources

• NIST (2023a). "Lightweight Cryptography Standardization Process: NIST Selects Ascon". nist.gov. National Institute of Standards and Technology.
• NIST (2023b). "NIST Selects 'Lightweight Cryptography' Algorithms to Protect Small Devices". nist.gov. National Institute of Standards and Technology.
• Dobraunig, Christoph; Eichlseder, Maria; Mendel, Florian; Schläffer, Martin (2016). "Ascon v1.2: Submission to the CAESAR Competition" (PDF). nist.gov. National Institute of Standards and Technology.
• Dobraunig, Christoph; Eichlseder, Maria; Mendel, Florian; Schläffer, Martin (22 June 2021). "Ascon v1.2: Lightweight Authenticated Encryption and Hashing".
  S2CID 253633576
  .

External links

• TU Graz. "Ascon: Publications". tugraz.at.

This cryptography-related article is a stub. You can help Wikipedia by expanding it.

• v
• t
• e