Ascon was designed to be easy to implement, without dependencies on other ciphers, finite field arithmetics or similar. The core permutation can be implemented efficiently in both hardware and software. Find out more on advantages of the Ascon design for optimized software and hardware implementations in the submission document.

Several software and hardware implementations are collected in our GitHub repository.


C [git] [zip]:

The repository features both the reference implementation and optimized implementations (64-bit) of Ascon-128 and Ascon-128a.
As a reference for standard desktop CPUs, Ascon-128 encrypts at about 10.5 cycles per byte on an Intel Haswell, while Ascon-128a takes only 7.1 cycles per byte.
Also on recent ARM CPUs such as ARM-A57 a similar performance is achieved.
For a detailed overview of the performance of Ascon-128 and Ascon-128a on different CPUs we refer to eBAEAD.

Python [git] [py]:

Simple, not optimized, all AEAD (Ascon-128, Ascon-128a, Ascon-80pq) and hash (Ascon-Hash, Ascon-Hasha, Ascon-Xof, Ascon-Xofa) variants.

Java [git] [zip]:

Simple, not optimized, Ascon-128 and Ascon-128a.

Rust [crate]:

Rust crate (v1.2, Ascon-128 and Ascon-128a AEAD variants).

C with Init-Update-Final structure by Matjaž Guštin [git]:

C11 library wrapping the reference C implementation (v1.2, all AEAD and hash variants), including Init-Update-Final processing and variable tag length.


NIST LWC Hardware API reference implementation by Robert Primas [git]:

Reference hardware implementations of Ascon-128 and Ascon-128a by Robert Primas using the NIST LWC Hardware API v1.0.3.

CAESAR Hardware API reference implementations by Hannes Groß [git]:

Reference hardware implementations of Ascon-128 and Ascon-128a by Hannes Groß using the CAESAR Hardware API v1.0. Note that the CAESAR API implies a certain overhead, in particular for lightweight designs like Ascon.

Ascon-128 (CAESAR Hardware API)
1 round 9420 GE 4888 Mbps
2 rounds12989 GE 8482 Mbps
3 rounds16589 GE10343 Mbps
6 rounds27280 GE12261 Mbps

Additional: Pre-Processor 869 GE, Post-Processor 1032 GE, HDR Buffer 836 GE

Ascon-128a (CAESAR Hardware API)
1 round 9680 GE 7326 Mbps
2 rounds13249 GE11743 Mbps
4 rounds20380 GE16675 Mbps

Additional: Pre-Processor 1491 GE, Post-Processor 1344 GE, HDR Buffer 836 GE

CAESAR Hardware API implementation by the Athena project [web]:

Hardware implementation of Ascon-128 and Ascon-128a, including a database of FPGA results for comparison with other CAESAR candidates.

Protected hardware implementation by Hannes Groß [git]:

Side-channel protected hardware implementations of Ascon-128 and Ascon-128a by Hannes Groß using domain-oriented masking.

Energy-efficient implementation by Michael Fivez [git]:

Energy-efficient implementations of Ascon-128 and Ascon-128a by Michael Fivez, including a comparison with Joltik and MORUS (master’s thesis).


RISC-V Ascon Accelerator [paper] [git]:

A fast and compact co-processor design for Ascon that can perform AEAD/hashing with a performance of about 2 cycles/byte, or about 4 cycles/byte if protection against fault attacks and power analysis is desired. This co-processor requires only 4.7 kGE, or about half the area of dedicated co-processor designs, and is easy to integrate into low-end embedded devices like 32-bit ARM Cortex-M or RISC-V microprocessors.

Runtime (cycles per byte) and code size comparison of Ascon, with/without 1-round Ascon-p hardware acceleration (Co-Proc.) on the RISC-V RI5CY core.
Design Implementation
64 B
1536 B

Ascon-128 (-O3) SW 164.3 c/B 110.6 c/B 108.3 c/B 11716 B
Ascon-Hash (-O3) SW 306.9 c/B 208.0 c/B 203.8 c/B 20244 B
Ascon128 SW+Coproc.     4.2 c/B     2.2 c/B     2.1 c/B     888 B
Ascon-Hash SW+Coproc.     4.6 c/B     2.6 c/B     2.5 c/B     484 B


Athena project’s CAESAR Hardware API benchmarks for FPGA and ASIC [web]:

Benchmarks and tools for hardware implementations. See “Publications” for various related publications.

eBACS/SUPERCOP: ECRYPT Benchmarking of Cryptographic Systems [web]:

Benchmark of software implementations of LWC and CAESAR candidates and other AEAD designs on a wide range of platforms.

Rhys Weatherley’s microcontroller benchmarks (ARM and AVR) [web] [git]:

Benchmark of software implementations of LWC candidates on 8-bit and 32-bit platforms: ARM Cortex M3, ESP32 Arduino, and ATmega2560.

LaS3’s LWC microcontroller benchmarks [web] [git] [talk]:

Benchmark of software implementations of LWC candidates on microcontrollers: Arduino Uno R3, STM32F1 “bluepill”, Espressif ESP32 WROOM, STM32 NUCLEO-F746ZG, Sipeed Maixduino RISC-V 64.

FELICS-AE benchmarks [git]:

Benchmark of LWC candidates based on the FELICS framework.

Ankele & Ankele’s software benchmarks for CAESAR [git] [paper]:

Software benchmarking of 2nd round CAESAR candidates