The Ascon family is specified in the CAESAR submission document.

### Mode

Ascon uses a sponge-based mode of operation. The recommended key, tag and nonce length is 128 bits. The sponge operates on a state of 320 bits, with injected message blocks of 64 or 128 bits. The core permutation iteratively applies an SPN-based round transformation with a 5-bit S-box and a lightweight linear layer.

The encryption process is split into four phases:

- Initialization, which updates the state with the key
*K*and nonce*N*, - Associated Data Processing, updating the state with associated data blocks
*A*,_{i} - Plaintext Processing, where plaintext blocks
*P*are injected into the state and ciphertext blocks_{i}*C*are extracted,_{i} - Finalization, which injects the key
*K*again and extracts a tag*T*for authentication.

After each injected block (except the last plaintext block), the core
permutation *p ^{b}* is applied to the complete state.
During initialization and finalization, a stronger permutation

*p*with more rounds is used. The numbers of rounds

^{a}*a*and

*b*, as well as the sponge's rate and capacity, depend on Ascon variant; the recommended values are:

cipher | bit size of | rounds | |||||||
---|---|---|---|---|---|---|---|---|---|

key | nonce | tag | rate | capacity | p^{a} | p^{b} | |||

Ascon-128 | 128 | 128 | 128 | 64 | 256 | 12 | 6 | ||

Ascon-128a | 128 | 128 | 128 | 128 | 192 | 12 | 8 |

### Round Permutation

The round permutation itself consists of three parts: a round constant addition, a nonlinear layer, and a linear layer.
The transformations operate on a 320-bit state, divided into 5 words *x _{0}, …, x_{4}* of 64 bits each.

The nonlinear S-box layer applies a 5-bit S-box 64 times in parallel in a bit-sliced fashion (vertically, across words):

The linear layer uses an xor of rotated copies of each word for horizontal diffusion within each word, with different rotation values for each word:

For details such as the round constant values, padding rules or the (almost identical) decryption mode, please refer to the Ascon submission document.