General | |
---|---|
Designers | C. Dobraunig, M. Eichlseder, F. Mendel, M. Schläffer [1] |
First published | 2014 |
Cipher detail | |
Key sizes | up to 128, 128 bits are recommended |
Block sizes | up to 128 bits, 128 and 64 bits are recommended |
Structure | sponge construction |
Rounds | 6–8 rounds per input word recommended |
Ascon is a family of lightweight authenticated ciphers and hash functions that have been selected by the U.S. National Institute of Standards and Technology (NIST) for cryptography on resource-constrained devices in 2025, specified in NIST SP 800-232. [2] [3] [4]
Ascon was developed in 2014 by a team of researchers from Graz University of Technology, Infineon Technologies, Lamarr Security Research, and Radboud University. [5] The cipher family was chosen as a finalist of the CAESAR Competition [5] in February 2019.
NIST announced its decision on February 7, 2023 [5] with the following steps that lead to its standardization: [2]
NIST finalized the standard on August 13, 2025, releasing it as "Ascon-Based Lightweight Cryptography Standards for Constrained Devices" (NIST Special Publication 800-232). [9]
The design is based on a sponge construction along the lines of SpongeWrap and MonkeyDuplex. This design makes it easy to reuse Ascon in multiple ways (as a cipher, hash, or a MAC). [10] As of February 2023, the Ascon suite contained seven ciphers, [5] including: [11]
The main components have been borrowed from other designs: [10]
The ciphers are parameterizable by the key length k (up to 128 bits), "rate" (block size) r, and two numbers of rounds a, b. All algorithms support authenticated encryption with plaintext P and additional authenticated data A (that remains unencrypted). The encryption input also includes a public nonce N, the output - authentication tag T, size of the ciphertext C is the same as that of P. The decryption uses N, A, C, and T as inputs and produces either P or signals verification failure if the message has been altered. Nonce and tag have the same size as the key K (k bits). [12]
In the CAESAR submission, two sets of parameters were recommended: [12]
Name | k | r | a | b |
---|---|---|---|---|
Ascon-128 | 128 | 64 | 12 | 6 |
Ascon-128a | 128 | 128 | 12 | 8 |
The data in both A and P is padded with a single bit with the value of 1 and a number of zeros to the nearest multiple of r bits. As an exception, if A is an empty string, there is no padding at all. [13]
The state consists of 320 bits, so the capacity . [14] The state is initialized by an initialization vector IV (constant for each cipher type, e.g., hex 80400c0600000000 for Ascon-128) concatenated with K and N. [15]
The initial state is transformed by applying a times the transformation function p (). On encryption, each word of A || P is XORed into the state and the p is applied b times (). The ciphertext C is contained in the first r bits of the result of the XOR. Decryption is near-identical to encryption. [14] The final stage that produces the tag T consists of another application of ; the special values are XORed into the last c bits after the initialization, the end of A, and before the finalization. [13]
Transformation p consists of three layers:
Hash values of an empty string (i.e., a zero-length input text) for both the XOF and non-XOF variants. [16]
Ascon-Hash("") 0x 7346bc14f036e87ae03d0997913088f5f68411434b3cf8b54fa796a80d251f91 Ascon-HashA("") 0x aecd027026d0675f9de7a8ad8ccf512db64b1edcf0b20c388a0c7cc617aaa2c4 Ascon-Xof("", 32) 0x 5d4cbde6350ea4c174bd65b5b332f8408f99740b81aa02735eaefbcf0ba0339e Ascon-XofA("", 32) 0x 7c10dffd6bb03be262d72fbe1b0f530013c6c4eadaabde278d6f29d579e3908d
Even a small change in the message will (with overwhelming probability) result in a different hash, due to the avalanche effect.
Ascon-Hash("The quick brown fox jumps over the lazy dog") 0x 3375fb43372c49cbd48ac5bb6774e7cf5702f537b2cf854628edae1bd280059e Ascon-Hash("The quick brown fox jumps over the lazy dog .") 0x c9744340ed476ac235dd979d12f5010a7523146ee90b57ccc4faeb864efcd048