Ascon

Implementation

Ascon was designed to be easy to implement, without dependencies on other ciphers, finite field arithmetics or similar. The core permutation can be implemented efficiently in both hardware and software. Find out more on advantages of the Ascon design for optimized software and hardware implementations in the submission document.

Several software and hardware implementations are collected in our GitHub repository.


Software

C [git] [zip]:

The repository features both the reference implementation and optimized implementations (64-bit) of Ascon-128 and Ascon-128a.
As a reference for standard desktop CPUs, Ascon-128 encrypts at about 10.5 cycles per byte on an Intel Haswell, while Ascon-128a takes only 7.1 cycles per byte.
Also on recent ARM CPUs such as ARM-A57 a similar performance is achieved.
For a detailed overview of the performance of Ascon-128 and Ascon-128a on different CPUs we refer to eBAEAD.

Python [git] [py]:

Simple, not optimized, Ascon-128 and Ascon-128a.

Java [git] [zip]:

Simple, not optimized, Ascon-128 and Ascon-128a.


Hardware

CAESAR Hardware API reference implementations [git]:

Reference hardware implementations of Ascon-128 and Ascon-128a by Hannes Groß using the CAESAR Hardware API v1.0. Note that the CAESAR API implies a certain overhead, in particular for lightweight designs like Ascon.

Ascon-128 (CAESAR Hardware API)
DesignAreaThroughput
1 round 9420 GE 4888 Mbps
2 rounds12989 GE 8482 Mbps
3 rounds16589 GE10343 Mbps
6 rounds27280 GE12261 Mbps
Additional: Pre-Processor 869 GE, Post-Processor 1032 GE, HDR Buffer 836 GE
Ascon-128a (CAESAR Hardware API)
DesignAreaThroughput
1 round 9680 GE 7326 Mbps
2 rounds13249 GE11743 Mbps
4 rounds20380 GE16675 Mbps
Additional: Pre-Processor 1491 GE, Post-Processor 1344 GE, HDR Buffer 836 GE

CAESAR Hardware API implementation by the Athena project [web]:

Hardware implementation of Ascon-128 and Ascon-128a, including a database of FPGA results for comparison with other CAESAR candidates.

Protected hardware implementation [git]:

Side-channel protected hardware implementations of Ascon-128 and Ascon-128a by Hannes Groß using domain-oriented masking.

Energy-efficient implementation by Michael Fivez [git]:

Energy-efficient implementations of Ascon-128 and Ascon-128a by Michael Fivez, including a comparison with Joltik and MORUS (master’s thesis).