View source for Ascon (cipher)

{{Short description|Family of authenticated ciphers}}
{{Other uses|Ascon (disambiguation){{!}}Ascon}}
{{Infobox encryption method
| name          = Ascon
| image         = 
| caption       = 
| designers     = C. Dobraunig, M. Eichlseder, F. Mendel, M. Schläffer<ref>{{cite web |last1=NIST |title=Status Report on the Second Round of the NIST Lightweight Cryptography Standardization Process |url=https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=932630 |website=nist.gov |publisher=[[National Institute of Standards and Technology]] |page=6 |date=July 2021}}</ref>
| publish date  = 2014
| derived from  = 
| derived to    = 
| related to    =
| certification = 
| key size      = up to 128, 128 bits are recommended
| block size    = up to 128 bits, 128 and 64 bits are recommended
| structure     = [[sponge construction]]
| rounds        = 6–8 rounds per input word recommended
| cryptanalysis = 
}}

'''Ascon''' is a family of [[lightweight cipher|lightweight]] [[authenticated cipher]]s that had been selected by US [[National Institute of Standards and Technology]] (NIST) for future standardization of the lightweight cryptography.{{sfn|NIST|2023a}}

== History ==
Ascon was developed in 2014 by a team of researchers from [[Graz University of Technology]], [[Infineon Technologies]], Lamarr Security Research, and [[Radboud University]].{{sfn|NIST|2023b}} The cipher family was chosen as a finalist of the [[CAESAR Competition]]{{sfn|NIST|2023b}} in February 2019.

NIST had announced its decision on February 7, 2023{{sfn|NIST|2023b}} with the following intermediate steps that would lead to the eventual standardization:{{sfn|NIST|2023a}}
* Publication of  NIST IR 8454 describing the process of evaluation and selection that was used;
* Preparation of a new draft for public comments;
* Public workshop to be held on June 21–22, 2023.

== Design ==
The design is based on a [[sponge construction]] along the lines of SpongeWrap and MonkeyDuplex. This design makes it easy to reuse Ascon in multiple ways (as a cipher, [[cryptographic hash|hash]], or a [[Message authentication code|MAC]]).{{sfn|Dobraunig|Eichlseder|Mendel|Schläffer|2016|p=17}} As of February 2023, the Ascon suite contained seven ciphers,{{sfn|NIST|2023b}} including:{{sfn|Dobraunig|Eichlseder|Mendel|Schläffer|2021|pp=4-5}}
* Ascon-128 and Ascon-128a authenticated ciphers;
* Ascon-Hash cryptographic hash;
* Ascon-Xof [[extendable-output function]];
* Ascon-80pq cipher with an "increased" 160-bit key.

The main components have been borrowed from other designs:{{sfn|Dobraunig|Eichlseder|Mendel|Schläffer|2016|p=17}}
* substitution layer utilizes a modified [[S-box]] from the {{mvar|χ}} function of [[Keccak]];
* permutation layer functions are similar to the <math>\Sigma</math> of [[SHA-2]].

=== Parameterization ===
The ciphers are parameterizable by the [[key length]] ''k'' (up to 128 bits), "rate" ([[Block size (cryptography)|block size]]) ''r'', and two numbers of [[Round (cryptography)|rounds]] ''a'', ''b''. All algorithms support [[authenticated encryption]] with plaintext P and [[additional authenticated data]] A (that remains unencrypted). The encryption input also includes a public [[Cryptographic nonce|nonce]] N, the output - [[authentication tag]] T, size of the ciphertext C is the same as that of P. The decryption uses N, A, C, and T as inputs and produces either P or signals verification failure if the message has been altered. Nonce and tag have the same size as the key K (''k'' bits).{{sfn|Dobraunig|Eichlseder|Mendel|Schläffer|2016|p=2}}

In the CAESAR submission, two sets of parameters were recommended:{{sfn|Dobraunig|Eichlseder|Mendel|Schläffer|2016|p=2}}
{| class="wikitable"
|+ Suggested parameters, bits
|-
! Name !! ''k'' !! ''r'' !! ''a'' !! ''b''
|-
| Ascon-128 || 128 || 64 || 12 || 6
|-
| Ascon-128a || 128 || 128 || 12 || 8
|}

=== Padding ===
The data in both A and P is padded with a single bit with the value of 1 and a number of zeros to the nearest multiple of {{mvar|r}} bits. As an exception, if A is an empty string, there is no padding at all.{{sfn|Dobraunig|Eichlseder|Mendel|Schläffer|2016|p=4}} 

=== State ===
The state consists of 320 bits, so the capacity <math>c=320-r</math>.{{sfn|Dobraunig|Eichlseder|Mendel|Schläffer|2016|p=3}} The state is initialized by an initialization vector IV (constant for each cipher type, e.g., hex 
80400c0600000000 for Ascon-128) concatenated with K and N.{{sfn|Dobraunig|Eichlseder|Mendel|Schläffer|2016|pp=4-5}} 

=== Transformation ===
The initial state is transformed by applying {{mvar|a}} times the transformation function {{mvar|p}}  (<math>p^a</math>). On encryption, each word of A || P is XORed into the state and the {{mvar|p}} is applied {{mvar|b}} times (<math>p^b</math>). The ciphertext C is contained in the first {{mvar|r}} bits of the result of the XOR. Decryption is near-identical to encryption.{{sfn|Dobraunig|Eichlseder|Mendel|Schläffer|2016|p=3}} The final stage that produces the tag T consists of another application of <math>p^a</math>; the special values are XORed into the last {{mvar|c}} bits after the initialization, the end of A, and before the finalization.{{sfn|Dobraunig|Eichlseder|Mendel|Schläffer|2016|p=4}}

Transformation {{mvar|p}} consists of three layers:
* <math>p_C</math>, XORing the [[round constant]]s;
* <math>p_S</math>, application of 5-bit [[S-box]]es;
* <math>p_L</math>, application of [[linear diffusion]].

==Test vectors==
Hash values of an empty string (i.e., a zero-length input text) for both the XOF and non-XOF variants.<ref>{{cite web |url=https://hashing.tools/ascon |website=hashing.tools |title=Ascon Hash Family}}</ref>
 {{color|green|Ascon-Hash("")}}
 0x&nbsp;7346bc14f036e87ae03d0997913088f5f68411434b3cf8b54fa796a80d251f91
 {{color|green|Ascon-HashA("")}}
 0x&nbsp;aecd027026d0675f9de7a8ad8ccf512db64b1edcf0b20c388a0c7cc617aaa2c4
 {{color|green|Ascon-Xof("", 32)}}
 0x&nbsp;5d4cbde6350ea4c174bd65b5b332f8408f99740b81aa02735eaefbcf0ba0339e
 {{color|green|Ascon-XofA("", 32)}}
 0x&nbsp;7c10dffd6bb03be262d72fbe1b0f530013c6c4eadaabde278d6f29d579e3908d

Even a small change in the message will (with overwhelming probability) result in a different hash, due to the [[avalanche effect]].
 {{color|green|Ascon-Hash("[[The quick brown fox jumps over the lazy dog]]")}}
 0x&nbsp;3375fb43372c49cbd48ac5bb6774e7cf5702f537b2cf854628edae1bd280059e
 {{color|green|Ascon-Hash("[[The quick brown fox jumps over the lazy dog]]{{highlight|.}}")}}
 0x&nbsp;c9744340ed476ac235dd979d12f5010a7523146ee90b57ccc4faeb864efcd048

==See also==
* [[Simon (cipher)|Simon]] and [[Speck (cipher)|Speck]], earlier lightweight cipher families released by the U.S. [[National Security Agency]]

==References==
{{Reflist}}

==Sources==
* {{cite web |last1=NIST |title=Lightweight Cryptography Standardization Process: NIST Selects Ascon |website=nist.gov |publisher=[[National Institute of Standards and Technology]] |url=https://csrc.nist.gov/News/2023/lightweight-cryptography-nist-selects-ascon |date=2023a}}
* {{cite web |last1=NIST |title=NIST Selects 'Lightweight Cryptography' Algorithms to Protect Small Devices |website=nist.gov |publisher=National Institute of Standards and Technology |url=https://www.nist.gov/news-events/news/2023/02/nist-selects-lightweight-cryptography-algorithms-protect-small-devices |date=2023b}}
* {{cite web |last1=Dobraunig | first1=Christoph | last2=Eichlseder | first2 = Maria | last3 = Mendel | first3 = Florian | first4 = Martin | last4 = Schläffer |title=Ascon v1.2: Submission to the CAESAR Competition |website=nist.gov |publisher=National Institute of Standards and Technology |url=https://csrc.nist.gov/CSRC/media/Projects/lightweight-cryptography/documents/round-2/spec-doc-rnd2/ascon-spec-round2.pdf |date=2016}}
* {{cite journal | last1 = Dobraunig | first1 = Christoph | last2 = Eichlseder | first2 = Maria | last3 = Mendel | first3 = Florian | last4 = Schläffer | first4 = Martin | title = Ascon v1.2: Lightweight Authenticated Encryption and Hashing | journal = [[Journal of Cryptology]] | date = 22 June 2021 | volume = 34 | issue = 3 | issn = 0933-2790 | eissn = 1432-1378 | doi = 10.1007/s00145-021-09398-9 | pmid = | s2cid = 253633576 | url = | doi-access = free | hdl = 2066/235128 | hdl-access = free }}

== External links ==
* {{cite web |last1=TU Graz |title=Ascon: Publications |url=https://ascon.iaik.tugraz.at/publications.html |website=tugraz.at}}

{{cryptography navbox | block}}

[[Category:Authenticated-encryption schemes]]
[[Category:Extendable-output functions]]
[[Category:Cryptographic hash functions]]


{{cryptography-stub}}