NIST SP 800-232 日本語訳

• Online and single pass. Ascon-AEAD128 is online, meaning that the \(i\)-th ciphertext block is determined by the key, nonce, associated data, and first \(i\) plaintext blocks. Ascon family members require only a single pass over the data.

\(K\)

\(N\)

\(A\)

\(i\)^th block of associated data \(A\)

\(A_i\)

\(P\)

\(i\)^th block of plaintext \(P\)

\(P_i\)

\(C\)

\(i\)^th block of ciphertext \(C\)

\(C_i\)

\(Z\)

\(i\)^th block of customization string \(Z\)

\(Z_i\)

\(T\)

\(\mathit{IV}\)

\(\mathtt{fail}\) Error message to indicate that the verification of authenticated ciphertext failed

\(M\)

\(i\)^th block of message \(M\)

\(M_i\)

Hash value \(H\)

\(H\)

\(i\)^th block of hash value \(H\)

\(H_i\)

\(\mathcal{S}\)

\(S_0, \ldots, S_4\) The five 64-bit words of the internal state \(\mathcal{S}\), where \(\mathcal{S} = S_0 \parallel S_1 \parallel \ldots \parallel S_4\)

\(j\)^th bit of \(S_i\), \(0 \le i \le 4\), \(0 \le j \le 63\)

\(s_{(i,j)}\)

\(S_i[j]\) \(j^{th}\) byte of state word \(S_i\) for \(0 \le i \le 4\), \(0 \le j \le 7\)

The subset of state \(\mathcal{S}\) beginning at index \(i\) and ending at index \(j\), inclusive.

\(S_{[i:j]}\)

When \(i > j\), \(S_{[i:j]}\) is the empty string. When \(i = j\), \(S_{[i:j]}\) is a single bit.

\(\lambda\) Length of the truncated tag in bits

\(c_i\) The constant value for round \(i\) of the Ascon permutation

\(p_C, p_S, p_L\) Constant-addition, substitution, and linear layers of the round function \(p\)

\(\{\mathtt{0},\mathtt{1}\}^*\)

\(\{\mathtt{0},\mathtt{1}\}^s\)

The set of all bit strings of length \(s\)

\(\mathtt{0}^s\)

When \(s \ge 0\), \(\mathtt{0}^s\) is the bit string that consists of \(s\) consecutive \(\mathtt{0}\)s. When \(s = 0\), then \(\mathtt{0}^s\) is the empty string.

\(|X|\) Length of the bitstring \(X\) in bits

Concatenation of bitstrings \(X\) and \(Y\)

\(X \parallel Y\)

Multiplication of integers \(x\) and \(y\)

\(x \times y\)

Addition of integers \(x\) and \(y\)

\(x + y\)

Subtraction of integers \(x\) and \(y\)

\(x - y\)

Division of integer \(x\) and non-zero integer \(y\)

\(x/y\)

Remainder in the integer division of \(x\) by \(y\)

\(x \bmod y\)

For a real number \(x\), the smallest integer greater than or equal to \(x\)

\(\lceil x \rceil\)

For a real number \(x\), the largest integer less than or equal to \(x\)

\(\lfloor x \rfloor\)

Composition of functions \(f\) and \(g\) (e.g., for functions \(f(x)\) and \(g(x)\), \(f \circ g\) is evaluated as \(f(g(x))\))

\(f \circ g\)

\(g(x)\), \(f \circ g\) is evaluated as \(f(g(x))\)) \(\odot\) Bitwise AND operation

\(\odot\)

\(\oplus\)

Right rotation (circular shift) by \(i\) bits of the 64-bit word \(X\), where the least significant bit is the rightmost bit

\(X \ggg i\)

Left shift by \(i\) bits

\(X \ll i\)

The subset of bitstring \(X\) beginning at index \(i\) and ending at index \(j\), inclusive. When \(i > j\), \(X_{[i:j]}\) is the empty string. When \(i = j\), \(X_{[i:j]}\) is a single bit.

\(X_{[i:j]}\)

Boolean operator to perform an equality comparison, (i.e., \(\mathtt{true}\) if \(x\) is equal to \(y\); otherwise, \(\mathtt{false}\))

\(x == y\)

\(\mathtt{0x}\) Hexadecimal notation

\(\operatorname{int64}(x)\)

64-bit representation of integer \(x\)

Parse function. The \(\operatorname{parse}(X,r)\) function parses the input bitstring \(X\) into a sequence of blocks \(X_0, X_1, \ldots, \widetilde{X}_\ell\), where \(\ell \leftarrow \lfloor |X|/r \rfloor\) (i.e., \(X \leftarrow X_0 \parallel X_1 \parallel \ldots \parallel \widetilde{X}_\ell\)). The \(X_i\) blocks for \(0 \le i \le \ell-1\) each have a bit length \(r\), whereas \(0 \le \widetilde{X}_\ell \le r-1\) (see Algorithm 1). When \(|X| \bmod r = 0\), the final block is empty (i.e., \(|\widetilde{X}_\ell| = 0\)).

Algorithm 1 \(\operatorname{parse}(X,r)\)
Input: bitstring \(X\), a positive integer \(r\)
Output: bitstrings \(X_0, \ldots, X_{\ell-1}, \widetilde{X_\ell}\)

\(\ell \leftarrow \lfloor |X|/r \rfloor\)
for \(i = 0\) to \(\ell-1\) do

\(X_i \leftarrow X_{[i \times r : (i+1) \times r - 1]}\)

\(\widetilde{X_\ell} \leftarrow X_{[\ell \times r : |X| - 1]}\)

return \(X_0, \ldots, X_{\ell-1}, \widetilde{X_\ell}\)

Padding rule. The function \(\operatorname{pad}(X,r)\) appends the bit \(\mathtt{1}\) to the bitstring \(X\), followed by the bitstring \(\mathtt{0}^j\), where \(j\) is equal to \((-|X|-1) \bmod r\). The length of the output bitstring is a multiple of \(r\) (see Algorithm 2). For examples of padding when representing the data as 64-bit unsigned integers, see Appendix A.2.

Algorithm 2 \(\operatorname{pad}(X,r)\)
Input: bitstring \(X\), a positive integer \(r\)
Output: padded bitstring \(X'\)

\(j \leftarrow (-|X|-1) \bmod r\)
\(X' \leftarrow X \parallel \mathtt{1} \parallel \mathtt{0}^j\)
return \(X'\)

This section specifies the \(\mathit{rnd}\)-round \(\mathit{Ascon}\text{-}p[\mathit{rnd}]\) permutations, where \(\mathit{rnd}\) indicates the number of rounds to be performed and \(1 \le \mathit{rnd} \le 16\). The permutations follow the Substitution-Permutation-Network (SPN) structure and consist of iterations of the round function \(p\) that is defined as the composition of three steps

where \(p_C\) is the constant-addition layer (see Sec. 3.2), \(p_S\) is the substitution layer (see Sec. 3.3), and \(p_L\) is the linear diffusion layer (see Sec. 3.4). This composition can also be written as a series of function invocations on an input \(x\) as \(p_L(p_S(p_C(x)))\).

Note that \(\mathit{Ascon}\text{-}p[8]\) and \(\mathit{Ascon}\text{-}p[12]\) are the main building blocks of the Ascon family, and the permutation instantiated with other numbers of rounds may later be used to standardize other functionalities.

The permutations operate on the 320-bit state \(\mathcal{S}\), which is represented as five 64-bit words denoted as \(S_i\) for \(0 \le i \le 4\):

Let \(s_{(i,j)}\) represent the \(j\)th bit of \(S_i\), \(0 \le j < 64\). In this specification of the Ascon permutation, each state word represents a 64-bit unsigned integer, where the least significant bit is the rightmost bit. Details on other representations of the state can be found in Appendix A.

3.2. Constant-Addition Layer \(p_C\)

The constant \(c_i\) of round \(i\) of the Ascon permutation \(\mathit{Ascon\text{-}p}[\mathit{rnd}]\) (instantiated with \(\mathit{rnd}\) rounds) for \(\mathit{rnd} \le 16\) and \(0 \le i \le \mathit{rnd}-1\) is defined as

where \(\mathtt{const}_0, \ldots, \mathtt{const}_{15}\) are defined in Table 5. The constant-addition layer \(p_C\) adds a 64-bit round constant \(c_i\) to \(S_2\) in round \(i\), for \(i \ge 0\),

Table 5. The constants \(\mathtt{const}_i\) to derive round constants of the Ascon permutations

Since the first 56 bits of the constants are zero, in practice, this is equivalent to applying the constant to only the least significant eight bits of \(S_2\), as shown in Figure 1.

Figure 1. Application of constant-addition layer \(p_C\) to Ascon state

3.3. Substitution Layer \(p_S\)

The substitution layer \(p_S\) updates the state \(\mathcal{S}\) with 64 parallel applications of the 5-bit substitution box \(\mathrm{SBox}\) as

for \(0 \le j < 64\), as shown in Figure 2.

Figure 2. Application of substitution layer \(p_S\) to Ascon state

The 5-bit \(\mathrm{SBox}\) is computed as

Table 6. Lookup table representation of \(\mathrm{SBox}\)

Note that 5-bit inputs are represented in hexadecimal (e.g., \(x = 1\) corresponds to \((0,0,0,0,1)\)).

3.4. Linear Diffusion Layer \(p_L\)

The linear diffusion layer \(p_L\) provides diffusion within each 64-bit word \(S_i\), as shown in Figure 4.

Figure 4. Application of linear diffusion layer \(p_L\) to Ascon state

This layer applies the linear functions \(\Sigma_i\) to their corresponding state words as \(S_i \leftarrow \Sigma_i(S_i)\) for \(0 \le i \le 4\), where each \(\Sigma_i\) is defined as:

\(\texttt{Ascon-AEAD128}\) consists of the encryption algorithm \(\texttt{Ascon-AEAD128.enc}\) (specified in Sec. 4.1.1) and the decryption algorithm \(\texttt{Ascon-AEAD128.dec}\) (specified in Sec. 4.1.2).

\(\texttt{Ascon-AEAD128.enc}\) takes a 128-bit secret key \(K\), a 128-bit nonce \(N\), variable-length associated data \(A\), and variable-length plaintext \(P\) as inputs and outputs ciphertext \(C\) (where \(|C| = |P|\)) and 128-authentication tag \(T\) (see Sec. 4.2.1 for the truncation option):

\(\texttt{Ascon-AEAD128.dec}\) takes key \(K\), nonce \(N\), associated data \(A\), ciphertext \(C\), and authentication tag \(T\) as inputs and outputs \(P\) if the tag is valid:

Algorithm 3 \(\texttt{Ascon-AEAD128.enc}(K, N, A, P)\)
Input: 128-bit key \(K\), 128-bit nonce \(N\), associated data \(A\), plaintext \(P\)
Output: ciphertext \(C\), 128-bit tag \(T\)

\(\mathit{IV} \leftarrow\) 0x00001000808c0001 ▷ Initialization

\(\mathcal{S} \leftarrow \mathit{IV} \parallel K \parallel N\)

\(\mathcal{S} \leftarrow \mathit{Ascon\text{-}p}[12](\mathcal{S})\)

\(\mathcal{S} \leftarrow \mathcal{S} \oplus (\mathtt{0}^{192} \parallel K)\)

if \(|A| > 0\) then ▷ Processing associated data

\(A_0, \ldots, A_{m-1}, \widetilde{A_m} \leftarrow \operatorname{parse}(A, 128)\)
\(A_m \leftarrow \operatorname{pad}(\widetilde{A_m}, 128)\)
for \(i = 0\) to \(m\) do
\(\mathcal{S} \leftarrow \mathit{Ascon\text{-}p}[8]((\mathcal{S}_{[0:127]} \oplus A_i) \parallel \mathcal{S}_{[128:319]})\)

\(\mathcal{S} \leftarrow \mathcal{S} \oplus (\mathtt{0}^{319} \parallel \mathtt{1})\)

\(P_0, \ldots, P_{n-1}, \widetilde{P_n} \leftarrow \operatorname{parse}(P, 128)\) ▷ Processing plaintext

\(\ell \leftarrow |\widetilde{P_n}|\)
for \(i = 0\) to \(n-1\) do

\(\mathcal{S}_{[0:127]} \leftarrow \mathcal{S}_{[0:127]} \oplus P_i\)

\(C_i \leftarrow \mathcal{S}_{[0:127]}\)

\(\mathcal{S} \leftarrow \mathit{Ascon\text{-}p}[8](\mathcal{S})\)

end for
\(\mathcal{S}_{[0:127]} \leftarrow \mathcal{S}_{[0:127]} \oplus \operatorname{pad}(\widetilde{P_n}, 128)\)

\(\widetilde{C_n} \leftarrow \mathcal{S}_{[0:\ell-1]}\)

\(C \leftarrow C_0 \parallel \ldots \parallel C_{n-1} \parallel \widetilde{C_n}\)

\(\mathcal{S} \leftarrow \mathit{Ascon\text{-}p}[12](\mathcal{S} \oplus (\mathtt{0}^{128} \parallel K \parallel \mathtt{0}^{64}))\) ▷ Finalization

\(T \leftarrow \mathcal{S}_{[192:319]} \oplus K\)

return \(C, T\)

1. Initialization of the state. Given a 128-bit \(K\) and a 128-bit \(N\), the 320-bit internal state \(\mathcal{S}\) is initialized as the concatenation of \(\mathit{IV}\), \(K\), and \(N\):

where the initialization value \(\mathit{IV}\) is 0x00001000808c0001 (see Appendix B for details on determining the IV and Appendix A for implementation notes regarding initialization). Next, \(\mathcal{S}\) is updated using the permutation \(\mathit{Ascon\text{-}p}[12]\) as

and followed by XORing the secret key \(K\) into the last 128 bits of internal state:

• If the AD is non-empty (i.e., \(|A| > 0\)): The associated data \(A\) is parsed into blocks as

where \(m = \lfloor |A|/128 \rfloor\) and \(|A_i| = 128\) bits for \(0 \le i \le m-1\) and \(0 \le |\widetilde{A_m}| < 128\), as explained in Algorithm 1. The last block \(\widetilde{A_m}\) can be empty. Next, \(\widetilde{A_m}\) is padded as

so that \(|A_m| = 128\), as explained in Algorithm 2.

Each associated data block \(A_i\) (\(0 \le i \le m\)) is absorbed into the first 128 bits of state as

and the permutation \(\mathit{Ascon}\text{-}p[8]\) is applied to the state as

The final step of processing associated data is to update the state with a constant

• If the AD is empty (i.e., \(|A| = 0\)): Only the final step described in (22) is applied.

3. Processing plaintext. Plaintext \(P\) (including empty plaintext) is parsed into blocks as

where \(n = \lfloor |P|/128 \rfloor\), \(|P_i| = 128\) for \(0 \le i \le n-1\), and \(|\widetilde{P_n}| = \ell\), \(0 \le \ell < 128\) using Algorithm 1. When \(|P| \bmod 128 = 0\), the last block \(\widetilde{P_n}\) is empty.

For each \(P_i\), \(0 \le i \le n-1\), the state \(\mathcal{S}\) is updated as

followed by generating the corresponding ciphertext block \(C_i\) as

and the permutation \(\mathit{Ascon}\text{-}\mathit{p}[8]\) is applied to update the state as

For the last block \(\widetilde{P_n}\), the state is updated as

and the last ciphertext block \(\widetilde{C_n}\) is obtained as

The ciphertext \(C\) is constructed by concatenating the ciphertext blocks as

4. Finalization and tag generation. During finalization, the key is first loaded to the state \(\mathcal{S}\) as

and the state \(\mathcal{S}\) is then updated using the permutation \(\mathit{Ascon}\text{-}\mathit{p}[12]\) as

Finally, the tag \(T\) is generated by XORing the key with the last 128 bits of the state:

The encryption algorithm returns the ciphertext \(C\) and the tag \(T\).

The pseudocode of \(\mathtt{Ascon\text{-}AEAD128.dec}\) is provided in Algorithm 4.

1. Initialization of the state. Given a 128-bit \(K\) and 128-bit \(N\), the 320-bit internal state \(\mathcal{S}\) is initialized as the concatenation of \(\mathit{IV}\), \(K\), and \(N\):

where the initial value \(\mathit{IV}\) is 0x00001000808c0001 (see Appendix B for details on determining the IV and Appendix A for implementation notes regarding initialization). Next, \(\mathcal{S}\) is updated using the permutation \(\mathit{Ascon\text{-}p}[12]\) as

• If the AD is non-empty (i.e., \(|A| > 0\)): The associated data \(A\) is parsed into blocks as

Algorithm 4 \(\mathtt{Ascon\text{-}AEAD128.dec}(K, N, A, C, T)\)
Input: 128-bit key \(K\), 128-bit nonce \(N\), associated data \(A\), ciphertext \(C\), 128-bit tag \(T\)
Output: plaintext \(P\) or \(\mathtt{fail}\)

\(\mathit{IV} \leftarrow\) 0x00001000808c0001 \(\triangleright\) Initialization

\(\mathcal{S} \leftarrow \mathit{IV} \parallel K \parallel N\)

\(\mathcal{S} \leftarrow \mathit{Ascon}\text{-}p[12](\mathcal{S})\)

\(\mathcal{S} \leftarrow \mathcal{S} \oplus (\mathsf{0}^{192} \parallel K)\)

if \(|A| > 0\) then

\(A_0, \ldots, A_{m-1}, \widetilde{A_m} \leftarrow \operatorname{parse}(A, 128)\)
\(A_m \leftarrow \operatorname{pad}(\widetilde{A_m}, 128)\)
for \(i = 0\) to \(m\) do
\(\mathcal{S} \leftarrow \mathit{Ascon}\text{-}p[8]((\mathcal{S}_{[0:127]} \oplus A_i) \parallel \mathcal{S}_{[128:319]})\)

\(\mathcal{S} \leftarrow \mathcal{S} \oplus (\mathsf{0}^{319} \parallel \mathsf{1})\)

\(C_0, \ldots, C_{n-1}, \widetilde{C_n} \leftarrow \operatorname{parse}(C, 128)\)

for \(i = 0\) to \(n-1\) do

\(P_i \leftarrow \mathcal{S}_{[0:127]} \oplus C_i\)

\(\mathcal{S}_{[0:127]} \leftarrow C_i\)

\(\mathcal{S} \leftarrow \mathit{Ascon}\text{-}p[8](\mathcal{S})\)

end for
\(\ell = |\widetilde{C_n}|\)

\(\widetilde{P_n} \leftarrow \mathcal{S}_{[0:\ell-1]} \oplus \widetilde{C_n}\)

\(\mathcal{S}_{[\ell:127]} \leftarrow \mathcal{S}_{[\ell:127]} \oplus (1 || 0^{127-\ell})\)

\(\mathcal{S}_{[0:\ell-1]} \leftarrow \widetilde{C_n}\)

\(\mathcal{S} \leftarrow \mathit{Ascon}\text{-}p[12](\mathcal{S} \oplus (\mathsf{0}^{128} \parallel K \parallel \mathsf{0}^{64}))\)

\(T' \leftarrow \mathcal{S}_{[192:319]} \oplus K\)

if \(T' == T\) then

\(P \leftarrow P_0 \parallel \ldots \parallel P_{n-1} \parallel \widetilde{P_n}\)

return \(P\)
else
return \(\mathtt{fail}\)
end if

where \(m = \lfloor |A|/128 \rfloor\) and \(|A_i| = 128\) bits for \(0 \le i \le m-1\) and \(0 \le |\widetilde{A_m}| < 128\), as explained in Algorithm 1. The last block \(\widetilde{A_m}\) can be empty.

\(\widetilde{A_m}\) is further processed by padding to a full \(r = 128\)-bit block using Algorithm 2 as

The associated data blocks \(A_i\)’s (\(0 \le i \le m\)) are absorbed into the state \(\mathcal{S}\) as follows:

and the permutation \(\mathit{Ascon}\text{-}p[8]\) is applied to the state as

• If the AD is empty (i.e., \(|A| = 0\)): Only the final step described in Equation (40) is applied.

3. Processing the ciphertext. Ciphertext \(C\) is parsed into blocks as

where \(n = \lfloor |C|/128 \rfloor\), \(|C_i| = 128\) for \(0 \le i \le n-1\), \(|\widetilde{C_n}| = \ell\) and \(0 \le \ell < 128\) using Algorithm 1. Ciphertext \(C\) or the last block of ciphertext \(\widetilde{C_n}\) can be empty.

For each \(C_i\), \(0 \le i \le n-1\), the following steps are applied:

For the last block of the ciphertext \(\widetilde{C_n}\) (with length \(\ell\)), the following steps are applied:

Note that when \(\widetilde{C_n}\) is an empty block, \(\widetilde{P_n}\) is an empty block as well.

The plaintext \(P\) is constructed by concatenating the plaintext blocks as

4. Finalization. During finalization, the key is loaded into the state \(\mathcal{S}\) as

and the state \(\mathcal{S}\) is then updated using the permutation Ascon-p[12] as

As the last step, the computed \(T'\) is compared with the input \(T\). If the two match, the plaintext \(P\) is returned. Otherwise, an error message \(\mathtt{fail}\) is returned.

Some applications may truncate the tag \(T\) to a specific length \(\lambda\) \((\le |T|)\). The truncation function outputs the leftmost \(\lambda\) bits of the tag (i.e., \(T_{[0:\lambda-1]}\)).

In this option, an additional 128-bit key is used to mask the input nonce. Let \(K = (K_1 \parallel K_2)\) be a 256-bit key, where \(|K_1| = |K_2| = 128\). \(\mathtt{Ascon\text{-}AEAD128}\) with nonce masking is processed as follows:

\(\mathtt{Ascon\text{-}AEAD128}\) with nonce masking should only be used when context-commitment security ² [12] and related-key security [13] are not concerns. This is because the encryption of \(\mathtt{Ascon\text{-}AEAD128}\) with nonce masking always outputs the same \((C, T)\) pair for two different input tuples \((K \parallel K', N, A, P)\) and \((K \parallel K'', N', A, P)\), where \(N \oplus K' = N' \oplus K''\).

R2. Secrecy of key. The \(\mathtt{Ascon\text{-}AEAD128}\) key shall be kept secret. When the nonce masking option is implemented, the masked nonce (i.e., \(N \oplus K_2\) in Equation (52)) shall also be kept secret.

R5. Limit on the maximum number of decryption failures. When the tag bit length \(\lambda\) satisfies \(64\le\lambda\le 128\), the probability of a forgery is low enough that decryption failures up to \(2^{\lambda-32}\) can be tolerated without compromising security. Therefore, the maximum number of decryption failures under a fixed key shall not exceed \(2^{\lambda-32}\). For shorter tags, with \(32\le\lambda<64\), the forgery probability is higher, in these cases, the number of allowable decryption failures should be limited to 1. However, if a careful risk analysis shows that the system’s overall security goal remains satisfied, this limit may be relaxed – up to the same bound of \(2^{\lambda-32}\).

R6. Data limit. The total amount of data processed during encryption and decryption, including the nonce, shall not exceed \(2^{54}\) bytes for a given key.

R7. Key update. The key shall be updated to a new key once the total amount of input data reaches the limit of \(2^{54}\) bytes, and should be updated when the number of decryption failures reaches its limit.

\(\mathtt{Ascon\text{-}AEAD128}\) with no tag truncation provides a \(128\)-bit security strength in the single-key and nonce-respecting setting for the confidentiality of the plaintext (except for its length) and the integrity of the tuple (nonce, associated data, ciphertext, tag), where the total number of input bytes is limited to \(2^{54}\) (i.e., \(2^{50}\) blocks).

Impact of truncation. For a tag of length \(\lambda\), a forgery attempt succeeds with a probability of \(2^{-\lambda}\). Once a forgery is successful, the confidentiality of the plaintext may be compromised, as the decryption algorithm could reveal some information about the plaintext. Therefore, in the single-key setting, \(\mathtt{Ascon\text{-}AEAD128}\) with tag length \(\lambda\) provides \(\lambda\)-bit security for both confidentiality and integrity in the nonce-respecting setting.Note that even if a forgery attempt is successful, the probability of another successful forgery is \(2^{-\lambda}\), provided that the secret key remains uncompromised. This also holds for the nonce masking option.

When \(u\) keys are independently selected for an application, \(\mathtt{Ascon\text{-}AEAD128}\) with no tag truncation provides a (\(128-\log_2 u\))-bit security strength in the nonce-respecting setting for the confidentiality of the plaintext and the integrity of the tuple (nonce, associated data, ciphertext, tag). Note that, in the nonce-respecting setting, an attacker may select the same nonce for use with different keys, but is not permitted to reuse a nonce with the same key.

When the same nonce is used with \(u\) keys, an attacker may discover one of the \(u\) keys with a time complexity of \(2^{128-\log_2 u}\), thereby compromising both confidentiality and integrity [14, 17–19].

To improve security in a multi-key setting, the nonce-masking implementation option with no truncation (see Sec. 4.2.2) can be used. This option provides 128-bit security (rather than \(128-\log_2 u\)) for confidentiality and integrity.

Impact of truncation. In the multi-key setting, \(\mathtt{Ascon\text{-}AEAD128}\) with tag length \(\lambda\) provides \(\min\{128-\log_2 u,\lambda\}\)-bit security for both confidentiality and integrity in the nonce-respecting setting. Additionally, when using the nonce-masking option with tag length \(\lambda\), it provides \(\lambda\)-bit security for both confidentiality and integrity in the same setting. Note that, similar to the single-key case, even if a forgery attempt is successful, the probability of another successful forgery is \(2^{-\lambda}\), provided that the secret key is uncompromised.

The confidentiality of plaintext both in \(\mathtt{Ascon\text{-}AEAD128}\) and \(\mathtt{Ascon\text{-}AEAD128}\) with nonce masking can be compromised if a nonce or, more specifically, (nonce, associated data) pair, is reused with the same secret key. However, these algorithms are designed to provide some resilience against unintentional nonce reuse.

When (\(N\), \(A\)) pairs are distinct for encryption per key: In the \(u\)-key setting, where \(u=1\) corresponds to a single key and \(u>1\) to multiple independent keys, the confidentiality and integrity guarantees of \(\mathtt{Ascon\text{-}AEAD128}\) and the nonce-masking option with a \(\lambda\)-bit tag are as follows:

• \(\mathtt{Ascon\text{-}AEAD128}\) provides \(\min\{128-\log_2 u,\lambda\}\) bits of security for both confidentiality and integrity.

• Nonce-masking option provides \(\lambda\)-bit security for both confidentiality and integrity.

These guarantees assume that each (\(N\), \(A\)) pair is used at most once per key, and that any given nonce is reused for encryption with the same key no more than \(2^{8}\) times. Additionally, even after a successful forgery, the probability of another successful forgery attempt remains at most \(2^{-\lambda}\), provided that none of the multiple keys is compromised. The resulting security levels under these conditions are summarized in Table 7.

Table 7. Security strength of \(\mathtt{Ascon\text{-}AEAD128}\) with \(\lambda\)-bit tag in the \(u\)-key setting, where (\(N\), \(A\)) pairs are distinct for encryption per key

When each (\(N\), \(A\)) pair are reused up to \(2^{8}\) times for encryption per key: In the \(u\)-key setting, where \(u\) denotes the number of independent keys, the integrity security guarantees of \(\mathtt{Ascon\text{-}AEAD128}\) and the nonce-masking option with a \(\lambda\)-bit tag are as follows:

• \(\mathtt{Ascon\text{-}AEAD128}\) provides \(\min\{128-\log_2 u,\lambda\}\) bits of integrity security.

• Nonce-masking option provides \(\lambda\)-bit integrity security.

These guarantees hold under the condition that each (\(N\), \(A\)) pair is reused at most \(2^{8}\) times for encryption with the same key. The corresponding integrity security levels are summarized in Table 8. Furthermore, for both \(\mathtt{Ascon\text{-}AEAD128}\) and the nonce-masking option, even after a successful forgery, the probability that a subsequent forgery attempt succeeds remains at most \(2^{-\lambda}\), provided that none of the multiple keys has been compromised.

Table 8. Integrity security strength of \(\mathtt{Ascon\text{-}AEAD128}\) with \(u\) keys in the nonce-misuse setting

Hash and XOF algorithms are built on the \(\mathit{Ascon}\text{-}p[12]\) permutation in a sponge-based mode. This section specifies three functions:

1. Hash function \(\mathtt{Ascon\text{-}Hash256}\), which produces a 256-bit digest

3. Customized XOF \(\mathtt{Ascon\text{-}CXOF128}\), which also produces arbitrary length outputs

The designs of these functions differ from the design of \(\mathtt{Ascon\text{-}AEAD128}\) in three important ways. First, they employ traditional sponge-based modes that only extract output from the state after all input data has been absorbed. Second, the rate of these functions is reduced to 64 bits — half the rate used in \(\mathtt{Ascon\text{-}AEAD128}\). Finally, the hash and XOF algorithms rely only on the \(\mathit{Ascon}\text{-}p[12]\) permutation, whereas \(\mathtt{Ascon\text{-}AEAD128}\) employs both \(\mathit{Ascon}\text{-}p[12]\) and \(\mathit{Ascon}\text{-}p[8]\).

In \(\mathtt{Ascon\text{-}XOF128}\), when different output lengths are specified for the same input message, the shorter output is a prefix of the longer one. If this prefix property is undesirable in a given application, domain separation offers a more robust solution. For instance, \(\mathtt{Ascon\text{-}CXOF128}\) enables domain separation by allowing output lengths to be encoded into the user-defined customization string.

5.1. Specification of \(\mathtt{Ascon\text{-}Hash256}\)

The mode of operation used by \(\mathtt{Ascon\text{-}Hash256}\) and \(\mathtt{Ascon\text{-}XOF128}\) is shown in Figure 7. This mode comprises three main steps: initialization, absorbing the message, and squeezing the output. The length of the output \(L\) is \(256\) for \(\mathtt{Ascon\text{-}Hash256}\) and \(L>0\) for \(\mathtt{Ascon\text{-}XOF128}\).

Note that the rate and capacity of \(\mathtt{Ascon\text{-}Hash256}\) are 64 and 256 bits, respectively.

Figure 7. Structure of \(\mathtt{Ascon\text{-}Hash256}\) and \(\mathtt{Ascon\text{-}XOF128}\)

\(\mathtt{Ascon\text{-}Hash256}\) takes a variable length message \(M\) as input and produces a 256-bit digest. The full specification of \(\mathtt{Ascon\text{-}Hash256}\) can be found in Algorithm 5 and operates as follows:

1. Initialization. The 320-bit internal state of \(\mathtt{Ascon\text{-}Hash256}\) is initialized with the concatenation of the 64-bit \(\mathit{IV} =\) 0x0000080100cc0002 and 256 zeroes, followed by the \(\mathit{Ascon\text{-}p}[12]\) permutation as

2. Absorbing the message. The absorbing phase behaves similarly to the associated data processing of \(\mathtt{Ascon\text{-}AEAD128}\). The message is parsed into blocks, as

where \(|M_i| = 64\) bits for \(0 \le i \le n-1\) and \(0 \le |\widetilde{M_n}| \le 63\). The last block \(\widetilde{M_n}\) can be empty. Next, \(\widetilde{M_n}\) is padded to create a full block \(M_n\):

Each message block \(M_i\) is XORed with the state as

For all message blocks except the final block \(M_n\), the XOR operation is immediately followed by applying \(\mathit{Ascon}\text{-}p[12]\) to the state.

3. Squeezing the hash. The squeezing phase begins after \(M_n\) is absorbed with an application of \(\mathit{Ascon}\text{-}p[12]\) to the state:

The value of \(\mathcal{S}_{[0:63]}\) is then taken as the 64-bit hash block \(H_i\), and the state is again updated by \(\mathit{Ascon}\text{-}p[12]\):

Steps (60) and (61) are repeated alternately until hash blocks \(H_0, H_1,\) and \(H_2\) have been extracted. The final hash block is then extracted but is not followed by the Ascon-p[12] permutation:

Algorithm 5 \(\mathtt{Ascon\text{-}Hash256}\)(\(M\))
Input: Bitstring \(M \in \{0,1\}^*\)
Output: Digest \(H \in \{0,1\}^{256}\)

\(\mathit{IV} \leftarrow\) 0x0000080100cc0002 ▷ Initialization
\(\mathcal{S} \leftarrow \mathit{Ascon}\text{-}p[12](\mathit{IV} \parallel 0^{256})\)

\(M_0, \ldots, M_{n-1}, \widetilde{M_n} \leftarrow \operatorname{parse}(M, 64)\)

\(M_n \leftarrow \operatorname{pad}(\widetilde{M_n}, 64)\)
for \(i = 0\) to \(n-1\) do

\(\mathcal{S}_{[0:63]} \leftarrow \mathcal{S}_{[0:63]} \oplus M_i\)

\(\mathcal{S} \leftarrow \mathit{Ascon}\text{-}p[12](\mathcal{S})\)

\(\mathcal{S}_{[0:63]} \leftarrow \mathcal{S}_{[0:63]} \oplus M_n\)

\(\mathcal{S} \leftarrow \mathit{Ascon}\text{-}p[12](\mathcal{S})\)

for \(i = 0\) to \(2\) do

\(H_i \leftarrow \mathcal{S}_{[0:63]}\)

\(\mathcal{S} \leftarrow \mathit{Ascon}\text{-}p[12](\mathcal{S})\)

\(H_3 \leftarrow \mathcal{S}_{[0:63]}\)

\(H \leftarrow H_0 \parallel H_1 \parallel H_2 \parallel H_3\)

return \(H\)

1. Ascon-XOF128 accepts an additional input \(L > 0\), which specifies the desired output length in bits.

2. The number of blocks that are squeezed is \(\lceil L/64 \rceil\).

1. Initialization. The 320-bit internal state of Ascon-XOF128 is initialized with the concatenation of the 64-bit \(\mathit{IV} =\) 0x0000080000cc0003 and 256 zeroes, followed by the \(\mathit{Ascon}\text{-}p[12]\) permutation:

where \(|M_i| = 64\) bits for \(0 \le i \le n-1\) and \(0 \le |\widetilde{M_n}| \le 63\). Partial block \(\widetilde{M_n}\) is then padded to a full block \(M_n\) as

Each message block \(M_i\) is absorbed by XORing the block into the state as

For all message blocks except the final block, the XOR operation is immediately followed by an application of \(\mathit{Ascon}\text{-}\mathit{p}[12]\) to the state:

3. Squeezing the outputs. To obtain the requested \(L\) output bits, \(h = \lceil L/64 \rceil\) blocks must be extracted from the state. The squeezing phase begins with an application of \(\mathit{Ascon}\text{-}\mathit{p}[12]\) to the state:

The value of \(\mathcal{S}_{[0:63]}\) is then taken as output block \(H_i\), and the state is again updated by \(\mathit{Ascon}\text{-}\mathit{p}[12]\):

Steps (70) and (71) are repeated alternately until output blocks \(H_0, \ldots, H_{h-1}\) have been squeezed. The final block is then squeezed without an additional permutation call:

Finally, the output blocks are concatenated, and the first \(L\) bits are returned as output \(H\):

Algorithm 6 \(\texttt{Ascon-XOF128}(M, L)\)
Input: Bitstring \(M \in \{0,1\}^*\), output length \(L > 0\)
Output: Digest \(H \in \{0,1\}^L\)

\(\mathit{IV} \leftarrow\) 0x0000080000cc0003
\(\mathcal{S} \leftarrow \mathit{Ascon}\text{-}\mathit{p}[12](\mathit{IV} \parallel 0^{256})\)

\(M_0, \ldots, M_{n-1}, \widetilde{M_n} \leftarrow \operatorname{parse}(M, 64)\)

\(M_n \leftarrow \operatorname{pad}(\widetilde{M_n}, 64)\)
for \(i = 0\) to \(n-1\) do

\(\mathcal{S}_{[0:63]} \leftarrow \mathcal{S}_{[0:63]} \oplus M_i\)

\(\mathcal{S} \leftarrow \mathit{Ascon}\text{-}\mathit{p}[12](\mathcal{S})\)

\(\mathcal{S}_{[0:63]} \leftarrow \mathcal{S}_{[0:63]} \oplus M_n\)

\(\mathcal{S} \leftarrow \mathit{Ascon}\text{-}p[12](\mathcal{S})\)

\(h \leftarrow \lceil L/64 \rceil - 1\)
for \(i = 0\) to \(h - 1\) do

\(H_i \leftarrow \mathcal{S}_{[0:63]}\)

\(\mathcal{S} \leftarrow \mathit{Ascon}\text{-}p[12](\mathcal{S})\)

\(H_h \leftarrow \mathcal{S}_{[0:63]}\)

\(H' \leftarrow H_0 \parallel \ldots \parallel H_h\)

\(H \leftarrow H'_{[0:L-1]}\)

return \(H\)

In addition to the message \(M\) and output length \(L\), \(\mathtt{Ascon\text{-}CXOF128}\) takes the customization string \(Z\) as input. After initialization, the length of \(Z\), in bits, is assigned to the 64-bit block \(Z_0\) as

Then, \(Z\) is parsed into blocks as

where \(|Z_i| = 64\) bits for \(0 \le i \le m-1\) and \(0 \le |\widetilde{Z_m}| \le 63\). The partial block \(\widetilde{Z_m}\) is then padded to a full block \(Z_m\) as

The customization string \(Z\) is prepended to the message blocks as

Algorithm 7 \(\mathtt{Ascon\text{-}CXOF128}(M, L, Z)\)
Input: Bitstring \(M \in \{0,1\}^*\), output length \(L > 0\), customization string \(Z \in \{0,1\}^*\), where \(|Z| \le 2048\)

Output: Digest \(H \in \{0,1\}^L\)

\(\mathit{IV} \leftarrow\) 0x0000080000cc0004
\(\mathcal{S} \leftarrow \mathit{Ascon}\text{-}p[12](\mathit{IV} \parallel 0^{256})\)

\(Z_0 \leftarrow \operatorname{int64}(|Z|)\)

\(Z_1 \ldots, Z_{m-1}, \widetilde{Z_m} \leftarrow \operatorname{parse}(Z, 64)\)
\(Z_m \leftarrow \operatorname{pad}(\widetilde{Z_m}, 64)\)
for \(i = 0\) to \(m\) do

\(\mathcal{S}_{[0:63]} \leftarrow \mathcal{S}_{[0:63]} \oplus Z_i\)

\(\mathcal{S} \leftarrow \mathit{Ascon}\text{-}p[12](\mathcal{S})\)

\(M_0, \ldots, M_{n-1}, \widetilde{M_n} \leftarrow \operatorname{parse}(M, 64)\)

\(M_n \leftarrow \operatorname{pad}(\widetilde{M_n}, 64)\)
for \(i = 0\) to \(n-1\) do

\(\mathcal{S}_{[0:63]} \leftarrow \mathcal{S}_{[0:63]} \oplus M_i\)

\(\mathcal{S} \leftarrow \mathit{Ascon}\text{-}p[12](\mathcal{S})\)

\(\mathcal{S}_{[0:63]} \leftarrow \mathcal{S}_{[0:63]} \oplus M_n\)

\(\mathcal{S} \leftarrow \mathit{Ascon}\text{-}p[12](\mathcal{S})\)

\(h \leftarrow \lceil L/64 \rceil - 1\)
for \(i = 0\) to \(h-1\) do

\(H_i \leftarrow \mathcal{S}_{[0:63]}\)

\(\mathcal{S} \leftarrow \mathit{Ascon}\text{-}p[12](\mathcal{S})\)

\(H_h \leftarrow \mathcal{S}_{[0:63]}\)

\(H' \leftarrow H_0 \parallel \ldots \parallel H_h\)

\(H \leftarrow H'_{[0:L-1]}\)

return \(H\)

Ascon-XOF128 and Ascon-CXOF128 support incremental processing of input data, without the prior knowledge of complete input or output lengths. This makes them suitable for applications where data is received or processed in blocks. In particular, when using Ascon-XOF128 and Ascon-CXOF128, it is not necessary to know the output length \(L\) at the time that the final block is squeezed.

• \(\mathit{ctx} \leftarrow \mathtt{Ascon\text{-}XOF128}.\mathrm{Init}()\)
Initializes and returns Ascon-XOF128 context \(\mathit{ctx}\).
Restriction: Must be called exactly once before any call to Absorb or Squeeze.

• \(\mathit{ctx} \leftarrow \mathtt{Ascon\text{-}XOF128}.\mathrm{Absorb}(\mathit{ctx}, \mathit{str})\)
Absorbs an arbitrary-length input \(\mathit{str}\) into the state and updates the context \(\mathit{ctx}\).
Restriction: May be called multiple times after Init, but cannot be called after any call to Squeeze.

• \((\mathit{ctx}, \mathit{out}) \leftarrow \mathtt{Ascon\text{-}XOF128}.\mathrm{Squeeze}(\mathit{ctx}, L)\)
Extracts \(L\) output bits produced during the squeezing phase of Ascon-XOF128 and updates context \(\mathit{ctx}\).
Restriction: May be called multiple times after the absorb phase is complete, but must not be called before Init. The first call of Squeeze handles the padding of the final message block. Once Squeeze is called, no further calls to Absorb are permitted.

These functions perform buffering of partial blocks, allowing both input and output to be processed in arbitrary-length segments. Therefore, these functions can then be used to begin execution without knowing the complete message \(M\) at the start of the absorption phase or the value \(L\) at the time that the final block is squeezed. This API is similar to those proposed for SHAKE-128 and SHAKE-256 in [22]. Similar interfaces can be defined for incremental implementations of Ascon-AEAD128 and Ascon-Hash256.

If the message is known to belong to a set \(\mathcal{M}\), the preimage resistance is also limited by the size of \(\mathcal{M}\). For more information about security strengths against preimage attacks in different scenarios, refer to [19, 23].

The least significant bit of \(S_0\) is \(s_{(0,0)}\) (i.e., \(\mathcal{S}_{[0:0]}\)), and the most significant bit of \(S_4\) is \(s_{(4,63)}\) (i.e., \(\mathcal{S}_{[319:319]}\)). Similarly, the least significant byte of \(S_0\) is the first byte of state (\(\mathcal{S}_{[0:7]}\)), and the most significant byte of \(S_4\) is the last byte of the state (\(\mathcal{S}_{[312:319]}\)). This relationship between state words, bytes, and state bits is shown in Fig. 9, where \(S_i[j]\) denotes the \(j^{th}\) byte of state word \(S_i\) for \(0 \le i \le 4\) and \(0 \le j \le 7\).

Loading 64-bit integer words from a byte sequence. When loading the state from a sequence of bytes stored in memory, the first eight bytes are mapped to the first 64-bit unsigned integer word \(S_0\) in little-endian notation (i.e., without byte reversal on little-endian machines). The next eight bytes are loaded to \(S_1\). Bytes continue to be loaded in the same way until the final eight bytes of the stored state are loaded into \(S_4\).

Table 10. Address for each byte of Ascon state word \(S_i\) in memory on little-endian and

big-endian machines, where the word \(S_i\) begins at memory address \(a\)

Padding. The padding rule described in Algorithm 2 appends a one followed by one or more zeroes to data. For an integer \(x\) that can be represented with \(n < 8\) bytes, an integer \(y\) that represents a padded version of \(x\) is computed as

Table 11. Examples of padding an unsigned integer \(x\) to a 64-bit block, where \(x\) encodes a sequence of bytes that each have value 0xFF in little-endian byte order

• \(v\) is a unique identifier for the algorithm (represented in 8 bits)

• \(a\) is the number of rounds during initialization and finalization (represented in 4 bits)

• \(b\) is the number of rounds during the processing of AD, plaintext, and ciphertext for Ascon-AEAD128 and the message for Ascon-Hash256, Ascon-XOF128, and Ascon-CXOF128 (represented in 4 bits)

• \(t\) is 128 for Ascon-AEAD128, 256 for Ascon-Hash256, and 0 for Ascon-XOF128 and Ascon-CXOF128 (represented in 16 bits)

• \(r/8\) is the number of input bytes processed per invocation of the underlying permutation (represented in 8 bits)