Ascon was designed to be easy to implement, without dependencies on other ciphers, finite field arithmetics or similar. The core permutation can be implemented efficiently in both hardware and software. Find out more on advantages of the Ascon design for optimized software and hardware implementations in the submission document.
Several software and hardware implementations are collected in our GitHub repository.
The repository features both the reference implementation and optimized
implementations (64-bit) of Ascon-128 and Ascon-128a.
As a reference for standard desktop CPUs, Ascon-128 encrypts at about 10.5 cycles per byte on an Intel Haswell, while Ascon-128a takes only 7.1 cycles per byte.
Also on recent ARM CPUs such as ARM-A57 a similar performance is achieved.
For a detailed overview of the performance of Ascon-128 and Ascon-128a on different CPUs we refer to eBAEAD.
Simple, not optimized, all AEAD (Ascon-128, Ascon-128a, Ascon-80pq) and hash (Ascon-Hash, Ascon-Hasha, Ascon-Xof, Ascon-Xofa) variants.
Simple, not optimized, Ascon-128 and Ascon-128a.
Rust crate (v1.2, Ascon-128 and Ascon-128a AEAD variants).
C with Init-Update-Final structure by Matjaž Guštin [git]:
C11 library wrapping the reference C implementation (v1.2, all AEAD and hash variants), including Init-Update-Final processing and variable tag length.
NIST LWC Hardware API reference implementation by Robert Primas [git]:
Reference hardware implementations of Ascon-128 and Ascon-128a by Robert Primas using the NIST LWC Hardware API v1.0.3.
CAESAR Hardware API reference implementations by Hannes Groß [git]:
Reference hardware implementations of Ascon-128 and Ascon-128a by Hannes Groß using the CAESAR Hardware API v1.0. Note that the CAESAR API implies a certain overhead, in particular for lightweight designs like Ascon.
|1 round||9420 GE||4888 Mbps|
|2 rounds||12989 GE||8482 Mbps|
|3 rounds||16589 GE||10343 Mbps|
|6 rounds||27280 GE||12261 Mbps|
Additional: Pre-Processor 869 GE, Post-Processor 1032 GE, HDR Buffer 836 GE
|1 round||9680 GE||7326 Mbps|
|2 rounds||13249 GE||11743 Mbps|
|4 rounds||20380 GE||16675 Mbps|
Additional: Pre-Processor 1491 GE, Post-Processor 1344 GE, HDR Buffer 836 GE
CAESAR Hardware API implementation by the Athena project [web]:
Hardware implementation of Ascon-128 and Ascon-128a, including a database of FPGA results for comparison with other CAESAR candidates.
Protected hardware implementation by Hannes Groß [git]:
Side-channel protected hardware implementations of Ascon-128 and Ascon-128a by Hannes Groß using domain-oriented masking.
Energy-efficient implementation by Michael Fivez [git]:
Energy-efficient implementations of Ascon-128 and Ascon-128a by Michael Fivez, including a comparison with Joltik and MORUS (master’s thesis).
A fast and compact co-processor design for Ascon that can perform AEAD/hashing with a performance of about 2 cycles/byte, or about 4 cycles/byte if protection against fault attacks and power analysis is desired. This co-processor requires only 4.7 kGE, or about half the area of dedicated co-processor designs, and is easy to integrate into low-end embedded devices like 32-bit ARM Cortex-M or RISC-V microprocessors.
|Ascon-128 (-O3)||SW||164.3 c/B||110.6 c/B||108.3 c/B||11716 B|
|Ascon-Hash (-O3)||SW||306.9 c/B||208.0 c/B||203.8 c/B||20244 B|
|Ascon128||SW+Coproc.||4.2 c/B||2.2 c/B||2.1 c/B||888 B|
|Ascon-Hash||SW+Coproc.||4.6 c/B||2.6 c/B||2.5 c/B||484 B|
Athena project’s CAESAR Hardware API benchmarks for FPGA and ASIC [web]:
Benchmarks and tools for hardware implementations. See “Publications” for various related publications.
eBACS/SUPERCOP: ECRYPT Benchmarking of Cryptographic Systems [web]:
Benchmark of software implementations of LWC and CAESAR candidates and other AEAD designs on a wide range of platforms.
Benchmark of software implementations of LWC candidates on 8-bit and 32-bit platforms: ARM Cortex M3, ESP32 Arduino, and ATmega2560.
Benchmark of software implementations of LWC candidates on microcontrollers: Arduino Uno R3, STM32F1 “bluepill”, Espressif ESP32 WROOM, STM32 NUCLEO-F746ZG, Sipeed Maixduino RISC-V 64.
FELICS-AE benchmarks [git]:
Benchmark of LWC candidates based on the FELICS framework.
Software benchmarking of 2nd round CAESAR candidates