Ascon

Specification

The Ascon family is specified in the CAESAR submission document.

Mode

Ascon uses a sponge-based mode of operation. The recommended key, tag and nonce length is 128 bits. The sponge operates on a state of 320 bits, with injected message blocks of 64 or 128 bits. The core permutation iteratively applies an SPN-based round transformation with a 5-bit S-box and a lightweight linear layer.

The encryption process is split into four phases:

  1. Initialization, which updates the state with the key K and nonce N,
  2. Associated Data Processing, updating the state with associated data blocks Ai,
  3. Plaintext Processing, where plaintext blocks Pi are injected into the state and ciphertext blocks Ci are extracted,
  4. Finalization, which injects the key K again and extracts a tag T for authentication.
Ascon sponge mode
The sponge mode for Ascon encryption     [pdf] [tex]

After each injected block (except the last plaintext block), the core permutation pb is applied to the complete state. During initialization and finalization, a stronger permutation pa with more rounds is used. The numbers of rounds a and b, as well as the sponge's rate and capacity, depend on Ascon variant; the recommended values are:

Recommended Parameters for Ascon
cipherbit size of rounds
keynoncetagratecapacitypapb
Ascon-12812812812864256126
Ascon-128a128128128128192128

Round Permutation

The round permutation itself consists of three parts: a round constant addition, a nonlinear layer, and a linear layer. The transformations operate on a 320-bit state, divided into 5 words x0, …, x4 of 64 bits each.

The nonlinear S-box layer applies a 5-bit S-box 64 times in parallel in a bit-sliced fashion (vertically, across words):

Sbox layer in Ascon sponge state
Ascon 5-bit sbox
Ascon S-box using xor ⊕, and ⊙, not ▽     [pdf] [tex] [C instructions]

The linear layer uses an xor of rotated copies of each word for horizontal diffusion within each word, with different rotation values for each word:

Linear layer in Ascon sponge state

x0 := x0 ⊕ (x0 ⋙ 19) ⊕ (x0 ⋙ 28)
x1 := x1 ⊕ (x1 ⋙ 61) ⊕ (x1 ⋙ 39)
x2 := x2 ⊕ (x2 ⋙   1) ⊕ (x2 ⋙   6)
x3 := x3 ⊕ (x3 ⋙ 10) ⊕ (x3 ⋙ 17)
x4 := x4 ⊕ (x4 ⋙   7) ⊕ (x4 ⋙ 41)
Ascon's linear layer; ⊕ denotes xor, ⋙ is rotation to the right.

For details such as the round constant values, padding rules or the (almost identical) decryption mode, please refer to the Ascon submission document.