{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,29]],"date-time":"2026-10-29T02:42:26Z","timestamp":1793241746071,"version":"4.5.0"},"reference-count":95,"publisher":"Springer Science and Business Media LLC","issue":"3","license":[{"start":{"date-parts":[[2021,6,22]],"date-time":"2021-06-22T00:00:00Z","timestamp":1624320000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2021,6,22]],"date-time":"2021-06-22T00:00:00Z","timestamp":1624320000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"DOI":"10.13039\/100008332","name":"Graz University of Technology","doi-asserted-by":"crossref","id":[{"id":"10.13039\/100008332","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["J Cryptol"],"published-print":{"date-parts":[[2021,7]]},"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>\n                    Authenticated encryption satisfies the basic need for authenticity and confidentiality in our information infrastructure. In this paper, we provide the specification of\n                    <jats:sc>Ascon<\/jats:sc>\n                    -128 and\n                    <jats:sc>Ascon<\/jats:sc>\n                    -128a. Both authenticated encryption algorithms provide efficient authenticated encryption on resource-constrained devices and on high-end CPUs. Furthermore, they have been selected as the \u201cprimary choice\u201d for lightweight authenticated encryption in the final portfolio of the CAESAR competition. In addition, we specify the hash function\n                    <jats:sc>Ascon-Hash<\/jats:sc>\n                    , and the extendable output function\n                    <jats:sc>Ascon-Xof<\/jats:sc>\n                    . Moreover, we complement the specification by providing a detailed overview of existing cryptanalysis and implementation results.\n                  <\/jats:p>","DOI":"10.1007\/s00145-021-09398-9","type":"journal-article","created":{"date-parts":[[2021,6,22]],"date-time":"2021-06-22T13:02:50Z","timestamp":1624366970000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":466,"title":["Ascon v1.2: Lightweight Authenticated Encryption and Hashing"],"prefix":"10.1007","volume":"34","author":[{"given":"Christoph","family":"Dobraunig","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Maria","family":"Eichlseder","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Florian","family":"Mendel","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Martin","family":"Schl\u00e4ffer","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2021,6,22]]},"reference":[{"key":"9398_CR1","unstructured":"R. Ankele, R. Ankele, Software benchmarking of the 2nd round CAESAR candidates (IACR, 2016). https:\/\/ia.cr\/2016\/740"},{"key":"9398_CR2","doi-asserted-by":"publisher","unstructured":"M. Agrawal, D. Chang, S. Sanadhya, sp-AELM: sponge based authenticated encryption scheme for memory constrained devices, in ACISP 2015. LNCS, vol. 9144 (Springer, 2015), pp. 451\u2013468. https:\/\/doi.org\/10.1007\/978-3-319-19962-7-26","DOI":"10.1007\/978-3-319-19962-7-26"},{"key":"9398_CR3","doi-asserted-by":"publisher","unstructured":"E. Andreeva, J. Daemen, B. Mennink, G. Van Assche, Security of keyed sponge constructions using a modular proof approach, in FSE 2015. LNCS, vol. 9054 (Springer, 2015), pp. 364\u2013384. https:\/\/doi.org\/10.1007\/978-3-662-48116-5-18","DOI":"10.1007\/978-3-662-48116-5-18"},{"key":"9398_CR4","unstructured":"A. Adomnicai, J.J.A. Fournier, L. Masson, Masking the lightweight authenticated ciphers ACORN and ascon in software (IACR, 2018). https:\/\/ia.cr\/2018\/708"},{"key":"9398_CR5","unstructured":"Athena project, Automated tool for hardware evaluation\u2014CAESAR hardware API (2016). https:\/\/cryptography.gmu.edu\/athena\/index.php?id=CAESAR_source_codes"},{"key":"9398_CR6","unstructured":"N. Bangma, Ascon: an attempt in NEON on the Cortex-A8. Bachelor\u2019s Thesis (2018). https:\/\/www.cs.ru.nl\/bachelorscripties\/2018\/Noel_Bangma___4433939___Ascon_An_attempt_in_NEON_on_the_Cortex-A8.pdf"},{"key":"9398_CR7","doi-asserted-by":"publisher","unstructured":"D. Bellizia, O. Bronchain, G. Cassiers, V. Grosso, C. Guo, C. Momin, O. Pereira, T. Peters, F.-X. Standaert, Mode-level vs. implementation-level physical security in symmetric cryptography\u2014a practical guide through the leakage-resistance jungle, in CRYPTO 2020. LNCS, vol. 12170 (Springer, 2020), pp. 369\u2013400. https:\/\/doi.org\/10.1007\/978-3-030-56784-2-13","DOI":"10.1007\/978-3-030-56784-2-13"},{"key":"9398_CR8","doi-asserted-by":"publisher","unstructured":"B. Bilgin, A. Bogdanov, M. Knezevic, F. Mendel, Q. Wang, Fides: lightweight authenticated cipher with side-channel resistance for constrained hardware, in CHES 2013. LNCS, vol. 8086 (Springer, 2013), pp. 142\u2013158. https:\/\/doi.org\/10.1007\/978-3-642-40349-1-9. IACR https:\/\/ia.cr\/2015\/424","DOI":"10.1007\/978-3-642-40349-1-9"},{"key":"9398_CR9","doi-asserted-by":"publisher","unstructured":"C. Boura, A. Canteaut, A zero-sum property for the Keccak-$$f$$ permutation with 18 Rounds, in ISIT 2010 (IEEE, 2010), pp. 2488\u20132492. https:\/\/doi.org\/10.1109\/ISIT.2010.5513442","DOI":"10.1109\/ISIT.2010.5513442"},{"key":"9398_CR10","doi-asserted-by":"publisher","unstructured":"C. Boura, A. Canteaut, C. De Canni\u00e8re, Higher-order differential properties of Keccak and Luffa, in FSE 2011. LNCS, vol. 6733 (Springer, 2011), pp. 252\u2013269. https:\/\/doi.org\/10.1007\/978-3-642-13858-4-15. IACR https:\/\/ia.cr\/2010\/589","DOI":"10.1007\/978-3-642-13858-4-15"},{"key":"9398_CR11","doi-asserted-by":"publisher","unstructured":"A. Bar-On, O. Dunkelman, N. Keller, A. Weizman, DLCT: a new tool for differential-linear cryptanalysis, in EUROCRYPT 2019. LNCS, vol. 11476 (Springer, 2019), pp. 313\u2013342. https:\/\/doi.org\/10.1007\/978-3-030-17653-2-11. IACR https:\/\/ia.cr\/2019\/256","DOI":"10.1007\/978-3-030-17653-2-11"},{"key":"9398_CR12","doi-asserted-by":"publisher","unstructured":"S. Bela\u00efd, P.-\u00c9. Dagand, D. Mercadier, M. Rivain, R. Wintersdorff, Tornado: automatic generation of probing-secure masked bitsliced implementations, in EUROCRYPT 2020. LNCS, vol. 12107 (Springer, 2020), pp. 311\u2013341. https:\/\/doi.org\/10.1007\/978-3-030-45727-3-11","DOI":"10.1007\/978-3-030-45727-3-11"},{"key":"9398_CR13","doi-asserted-by":"crossref","unstructured":"G. Bertoni, J. Daemen, M. Peeters, G. Van Assche, R. Van Keer, Keccak implementation overview version 3.2 (2012). https:\/\/keccak.team","DOI":"10.1007\/978-3-642-38348-9_19"},{"key":"9398_CR14","unstructured":"G. Bertoni, J. Daemen, M. Peeters, G. Van Assche, Sponge functions, in Ecrypt Hash Workshop 2007 (2007). https:\/\/keccak.team\/files\/SpongeFunctions.pdf"},{"key":"9398_CR15","doi-asserted-by":"publisher","unstructured":"G. Bertoni, J. Daemen, M. Peeters, G. Van Assche, On the Indifferentiability of the Sponge Construction, in EUROCRYPT 2008. LNCS, vol. 4965 (Springer, 2008), pp. 181\u2013197. https:\/\/doi.org\/10.1007\/978-3-540-78967-3-11. https:\/\/keccak.team\/files\/SpongeIndifferentiability.pdf","DOI":"10.1007\/978-3-540-78967-3-11"},{"key":"9398_CR16","doi-asserted-by":"publisher","unstructured":"G. Bertoni, J. Daemen, M. Peeters, G. Van Assche, Sponge-based pseudo-random number generators, in CHES 2010. LNCS, vol. 6225 (Springer, 2010), pp. 33\u201347. https:\/\/doi.org\/10.1007\/978-3-642-15031-9-3. https:\/\/keccak.team\/files\/SpongePRNG.pdf","DOI":"10.1007\/978-3-642-15031-9-3"},{"key":"9398_CR17","doi-asserted-by":"publisher","unstructured":"G. Bertoni, J. Daemen, M. Peeters, G. Van Assche, Duplexing the sponge: single-pass authenticated encryption and other applications, in SAC 2011. LNCS, vol. 7118 (Springer, 2011), pp. 320\u2013337. https:\/\/doi.org\/10.1007\/978-3-642-28496-0-19. IACR https:\/\/ia.cr\/2011\/499","DOI":"10.1007\/978-3-642-28496-0-19"},{"key":"9398_CR18","unstructured":"G. Bertoni, J. Daemen, M. Peeters, G. Van Assche, On the security of the keyed sponge construction, in SKEW 2011 (2011). https:\/\/keccak.team\/files\/SpongeKeyed.pdf"},{"key":"9398_CR19","unstructured":"G. Bertoni, J. Daemen, M. Peeters, G. Van Assche, The Keccak reference. Submission to NIST (Round 3) (2011). https:\/\/keccak.team"},{"key":"9398_CR20","unstructured":"G. Bertoni, J. Daemen, M. Peeters, G. Van Assche, Permutation-based encryption, authentication and authenticated encryption, in DIAC 2012, July 2012 (2012)"},{"key":"9398_CR21","unstructured":"D. J. Bernstein, Second preimages for 6 (7 (8??)) rounds of Keccak? Posted on the NIST mailing list (2010). https:\/\/ehash.iaik.tugraz.at\/uploads\/6\/65\/NIST-mailing-list_Bernstein-Daemen.txt"},{"key":"9398_CR22","doi-asserted-by":"publisher","unstructured":"G. Brassard, P. H\u00f8yer, A. Tapp, Quantum cryptanalysis of hash and claw-free functions, in LATIN \u201998. LNCS, vol. 1380 (Springer, 1998), pp. 163\u2013169. https:\/\/doi.org\/10.1007\/BFb0054319","DOI":"10.1007\/BFb0054319"},{"issue":"3","key":"9398_CR23","doi-asserted-by":"publisher","first-page":"369","DOI":"10.1007\/s10623-012-9697-z","volume":"70","author":"A Bogdanov","year":"2014","unstructured":"A. Bogdanov, V. Rijmen, Linear hulls with correlation zero and linear cryptanalysis of block ciphers. Des. Codes Cryptogr. 70(3), 369\u2013383 (2014). https:\/\/doi.org\/10.1007\/s10623-012-9697-z","journal-title":"Des. Codes Cryptogr."},{"key":"9398_CR24","doi-asserted-by":"publisher","unstructured":"J. Czajkowski, L.G. Bruinderink, A. H\u00fclsing, C. Schaffner, D. Unruh, Post-quantum security of the sponge construction, in PQCrypto 2018. LNCS, vol. 10786 (Springer, 2018), pp. 185\u2013204. https:\/\/doi.org\/10.1007\/978-3-319-79063-3-9","DOI":"10.1007\/978-3-319-79063-3-9"},{"key":"9398_CR25","doi-asserted-by":"publisher","unstructured":"S. Chari, C. S. Jutla, J. R. Rao, P. Rohatgi, Towards sound approaches to counteract power-analysis attacks, in CRYPTO \u201999. LNCS, vol. 1666 (Springer, 1999), pp. 398\u2013412. https:\/\/doi.org\/10.1007\/3-540-48405-1","DOI":"10.1007\/3-540-48405-1"},{"key":"9398_CR26","unstructured":"J. Daemen, Personal communication about implementing the 3-bit c layer. Dec. 2018 (2018)"},{"key":"9398_CR27","unstructured":"J. Daemen, Cipher and hash function design. Strategies based on linear and differential cryptanalysis. PhD thesis (Katholieke Universiteit Leuven, 1995). https:\/\/www.esat.kuleuven.be\/cosic\/publications\/thesis-6.pdf"},{"key":"9398_CR28","unstructured":"L. De Meyer, Looking at the NIST lightweight candidates from a masking point-of-view. IACR Cryptology ePrint Archive, Report 2020\/699 (2020). IACR https:\/\/ia.cr\/2020\/699"},{"key":"9398_CR29","doi-asserted-by":"publisher","unstructured":"W. Diehl, A. Abdulgadir, F. Farahmand, J.-P. Kaps, K. Gaj, Comparison of cost of protection against differential power analysis of selected authenticated ciphers, in HOST 2018 (IEEE Computer Society, 2018), pp. 147\u2013152. https:\/\/doi.org\/10.1109\/HST.2018.8383904","DOI":"10.1109\/HST.2018.8383904"},{"key":"9398_CR30","doi-asserted-by":"publisher","unstructured":"J. Daemen, C. Dobraunig, M. Eichlseder, H. Gross, F. Mendel, R. Primas, Protecting against Statistical Ineffective Fault Attacks\u201d. In: IACR Transactions on Cryptographic Hardware and Embedded Systems 2020.3 (2020), pp. 508\u2013543. https:\/\/doi.org\/10.13154\/tches.v2020.i3.508-543. IACR https:\/\/ia.cr\/2019\/536","DOI":"10.13154\/tches.v2020.i3.508-543"},{"key":"9398_CR31","doi-asserted-by":"publisher","unstructured":"C. Dobraunig, M. Eichlseder, F. Mendel, Heuristic tool for linear cryptanalysis with applications to CAESAR candidates, in ASIACRYPT 2015. LNCS, vol. 9453 (Springer, 2015), pp. 490\u2013509. https:\/\/doi.org\/10.1007\/978-3-662-48800-3-20. IACR https:\/\/ia.cr\/2015\/1200","DOI":"10.1007\/978-3-662-48800-3-20"},{"key":"9398_CR32","unstructured":"C. Dobraunig, M. Eichlseder, F. Mendel, M. Schl\u00e4ffer, Ascon v1. Submission to the CAESAR competition (2014). https:\/\/ascon.iaik.tugraz.at"},{"key":"9398_CR33","unstructured":"C. Dobraunig, M. Eichlseder, F. Mendel, M. Schl\u00e4ffer, Ascon v1.1. Submission to Round 2 of the CAESAR competition (2015). https:\/\/ascon.iaik.tugraz.at"},{"key":"9398_CR34","doi-asserted-by":"publisher","unstructured":"C. Dobraunig, M. Eichlseder, F. Mendel, M. Schl\u00e4ffer, Cryptanalysis of Ascon, in CT-RSA 2015. LNCS, vol. 9048 (Springer, 2015), pp. 371\u2013387. https:\/\/doi.org\/10.1007\/978-3-319-16715-2-20. IACR https:\/\/ia.cr\/2015\/030","DOI":"10.1007\/978-3-319-16715-2-20"},{"key":"9398_CR35","unstructured":"C. Dobraunig, M. Eichlseder, F. Mendel, M. Schl\u00e4ffer, Ascon v1.2. Submission to Round 3 of the CAESAR competition (2016). https:\/\/ascon.iaik.tugraz.at"},{"key":"9398_CR36","unstructured":"C. Dobraunig, M. Eichlseder, F. Mendel, M. Schl\u00e4ffer, Ascon v1.2. Submission to NIST (2019). https:\/\/ascon.iaik.tugraz.at"},{"key":"9398_CR37","unstructured":"C. Dobraunig, M. Eichlseder, F. Mendel, M. Schl\u00e4ffer, Preliminary analysis of Ascon-Xof and Ascon-Hash. Technical Report (2019). https:\/\/ascon.iaik.tugraz.at"},{"key":"9398_CR38","unstructured":"L.C. dos Santos, Software implementation of authenticated encryptionalgorithms on ARM processors. Master\u2019s Thesis (2018). http:\/\/repositorio.unicamp.br\/jspui\/bitstream\/REPOSIP\/332624\/1\/Santos_LuanCardosoDos_M.pdf"},{"key":"9398_CR39","doi-asserted-by":"publisher","unstructured":"L.C. dos Santos, J. Gro\u00dfsch\u00e4dl, A. Biryukov, FELICSAEAD: benchmarking of lightweight authenticated encryption algorithms, in CARDIS 2019. LNCS, vol. 11833 (Springer, 2019), pp. 216\u2013233. https:\/\/doi.org\/10.1007\/978-3-030-42068-0-13","DOI":"10.1007\/978-3-030-42068-0-13"},{"key":"9398_CR40","doi-asserted-by":"publisher","first-page":"202","DOI":"10.1016\/j.micpro.2017.06.003","volume":"52","author":"W Diehl","year":"2017","unstructured":"W. Diehl, K. Gaj, RTL implementations and FPGA benchmarking of selected CAESAR Round Two authenticated ciphers. Microprocess. Microsyst. 52, 202\u2013218 (2017). https:\/\/doi.org\/10.1016\/j.micpro.2017.06.003","journal-title":"Microprocess. Microsyst."},{"key":"9398_CR41","doi-asserted-by":"publisher","unstructured":"J. Daemen, S. Hoffert, G. Van Assche, R. Van Keer, The design of Xoodoo and Xoofff. IACR Trans. Symmetric Cryptol. 2018(4), 1\u201338 (2018). https:\/\/doi.org\/10.13154\/tosc.v2018.i4. IACR https:\/\/ia.cr\/2018\/767","DOI":"10.13154\/tosc.v2018.i4"},{"key":"9398_CR42","doi-asserted-by":"publisher","unstructured":"A.D. Dwivedi, M. Kloucek, P. Morawiecki, I. Nikolic, J. Pieprzyk, S. W\u00f3jtowicz, SAT-based cryptanalysis of authenticated ciphers from the CAESAR competition, in SECRYPT ICETE 2017 (SciTePress, 2017), pp. 237\u2013246. https:\/\/doi.org\/10.5220\/0006387302370246. IACR https:\/\/ia.cr\/2016\/1053","DOI":"10.5220\/0006387302370246"},{"key":"9398_CR43","doi-asserted-by":"publisher","unstructured":"J. Daemen, B. Mennink, G. Van Assche, Full-state keyed duplex with built-in multi-user support. In: ASIACRYPT 2017. LNCS, vol. 10625 (Springer, 2017), pp. 606\u2013637. https:\/\/doi.org\/10.1007\/978-3-319-70697-9-21. IACR https:\/\/ia.cr\/2017\/498","DOI":"10.1007\/978-3-319-70697-9-21"},{"key":"9398_CR44","unstructured":"C. De Canni\u00e8re, H. Sato, D. Watanabe, Hash function luffa: specification. Submission to NIST (Round 2) (2009). https:\/\/www.hitachi.com\/rd\/yrl\/crypto\/luffa\/"},{"key":"9398_CR45","unstructured":"eBACS: ECRYPT benchmarking of cryptographic systems. https:\/\/bench.cr.yp.to (visited on 02\/14\/2019)"},{"key":"9398_CR46","doi-asserted-by":"publisher","unstructured":"F. Farahmand, W. Diehl, A. Abdulgadir, J.-P. Kaps, K. Gaj, Improved lightweight implementations of CAESAR authenticated ciphers, in FCCM 2018 (IEEE Computer Society, 2018), pp. 29\u201336. https:\/\/doi.org\/10.1109\/FCCM.2018.00014","DOI":"10.1109\/FCCM.2018.00014"},{"key":"9398_CR47","unstructured":"M. Fivez, Energy Efficient Hardware Implementations of CAESAR Submissions. Master\u2019s Thesis (2016). https:\/\/www.esat.kuleuven.be\/cosic\/publications\/thesis-279.pdf"},{"key":"9398_CR48","doi-asserted-by":"publisher","unstructured":"C. Forler, E. List, S. Lucks, J. Wenzel, Reforgeability of authenticated encryption schemes, in ACISP 2017. LNCS, vol. 10343 (Springer, 2017), pp. 19\u201337. https:\/\/doi.org\/10.1007\/978-3-319-59870-3-2. IACR https:\/\/ia.cr\/2017\/332","DOI":"10.1007\/978-3-319-59870-3-2"},{"key":"9398_CR49","unstructured":"K. Gaj, ATHENa Team, ATHENa: automated tool for hardware evaluation (2016). https:\/\/cryptography.gmu.edu\/athena\/"},{"key":"9398_CR50","doi-asserted-by":"publisher","unstructured":"H. Gross, R. Iusupov, R. Bloem, Generic low-latency masking in hardware. IACR Trans. Cryptogr. Hardw. Embed. Syst. 2018(2), 1\u201321 (2018). https:\/\/doi.org\/10.13154\/tches.v2018.i2.1-21. IACR https:\/\/ia.cr\/2017\/1223","DOI":"10.13154\/tches.v2018.i2.1-21"},{"key":"9398_CR51","doi-asserted-by":"publisher","unstructured":"H. Gross, S. Mangard, Reconciling d+1 masking in hardware and software, in CHES 2017. LNCS, vol. 10529 (Springer, 2017), pp. 115\u2013136. https:\/\/doi.org\/10.1007\/978-3-319-66787-4-6. IACR https:\/\/ia.cr\/2017\/103","DOI":"10.1007\/978-3-319-66787-4-6"},{"issue":"2","key":"9398_CR52","doi-asserted-by":"publisher","first-page":"109","DOI":"10.1007\/s13389-018-0184-y","volume":"8","author":"H Gross","year":"2018","unstructured":"H. Gross, S. Mangard, A unified masking approach. J. Cryptogr. Eng. 8(2), 109\u2013124 (2018). https:\/\/doi.org\/10.1007\/s13389-018-0184-y","journal-title":"J. Cryptogr. Eng."},{"key":"9398_CR53","doi-asserted-by":"publisher","unstructured":"H. Gro\u00df, S. Mangard, T. Korak, Domain-oriented masking: compact masked hardware implementations with arbitrary protection order, in TIS@CCS 2016 (ACM, 2016), p. 3. https:\/\/doi.org\/10.1145\/2996366.2996426. IACR https:\/\/ia.cr\/2016\/486","DOI":"10.1145\/2996366.2996426"},{"key":"9398_CR54","doi-asserted-by":"publisher","unstructured":"L. Goubin, J. Patarin, DES and differential power analysis (the \u201cduplication\u201d method), in CHES \u201999. LNCS, vol. 1717 (Springer, 1999), pp. 158\u2013172. https:\/\/doi.org\/10.1007\/3-540-48059-5","DOI":"10.1007\/3-540-48059-5"},{"key":"9398_CR55","doi-asserted-by":"publisher","unstructured":"C. Guo, O. Pereira, T. Peters, F.-X. Standaert, Towards low-energy leakage-resistant authenticated encryption from the duplex sponge construction. IACR Trans. Symmetric Cryptol. 2020(1), 6\u201342 (2020). https:\/\/doi.org\/10.13154\/tosc.v2020.i1. IACR https:\/\/ia.cr\/2019\/193","DOI":"10.13154\/tosc.v2020.i1"},{"key":"9398_CR56","unstructured":"H. Gross, Reference hardware implementations of Ascon-128 and Ascon-128a using the CAESAR Hardware API v1.0. (2016). https:\/\/github.com\/IAIK\/ascon_hardware\/tree\/master\/caesar_hardware_api_v_1_0_3\/ASCON_ASCON"},{"key":"9398_CR57","doi-asserted-by":"publisher","unstructured":"L. K. Grover, A fast quantum mechanical algorithm for database search, in STOC \u201996 (ACM, 1996), pp. 212\u2013219. https:\/\/doi.org\/10.1145\/237814.237866","DOI":"10.1145\/237814.237866"},{"key":"9398_CR58","unstructured":"F. G\u00f6loglu, V. Rijmen, Q. Wang, On the division property of S-boxes. IACR Cryptology ePrint Archive, Report 2016\/188 (2016). IACR https:\/\/ia.cr\/2016\/188"},{"key":"9398_CR59","doi-asserted-by":"publisher","unstructured":"H. Gross, E. Wenger, C. Dobraunig, C. Ehrenh\u00f6fer, Suit up!\u2014made-to-measure hardware implementations of Ascon, in DSD 2015 (IEEE Computer Society, 2015), pp. 645\u2013652. https:\/\/doi.org\/10.1109\/DSD.2015.14. IACR https:\/\/ia.cr\/2015\/034","DOI":"10.1109\/DSD.2015.14"},{"key":"9398_CR60","doi-asserted-by":"publisher","first-page":"470","DOI":"10.1016\/j.micpro.2016.10.006","volume":"52","author":"H Gross","year":"2017","unstructured":"H. Gross, E. Wenger, C. Dobraunig, C. Ehrenh\u00f6fer, Ascon hardware implementations and side-channel evaluation. Microprocess. Microsyst. 52, 470\u2013479 (2017). https:\/\/doi.org\/10.1016\/j.micpro.2016.10.006","journal-title":"Microprocess. Microsyst."},{"key":"9398_CR61","unstructured":"E. Homsirikamol, W. Diehl, A. Ferozpuri, F. Farahmand, P. Yalla, J.-P. Kaps, K. Gaj, CAESAR hardware API. IACR Cryptology ePrint Archive, Report 2016\/626 (2016). IACR https:\/\/ia.cr\/2016\/626"},{"key":"9398_CR62","doi-asserted-by":"publisher","unstructured":"P. Jovanovic, A. Luykx, B. Mennink, Beyond $$2^c\/2$$ security in sponge-based authenticated encryption modes, in ASIACRYPT 2014. LNCS, vol. 8873 (Springer, 2014), pp. 85\u2013104. https:\/\/doi.org\/10.1007\/978-3-662-45611-8-5. IACR https:\/\/ia.cr\/2014\/373","DOI":"10.1007\/978-3-662-45611-8-5"},{"key":"9398_CR63","unstructured":"J.-P. Kaps, W. Diehl, M. Tempelmeier, F. Farahmand, E. Homsirikamol, K. Gaj, A comprehensive framework for fair and efficient benchmarking of hardware implementations of lightweight cryptography. IACR Cryptology ePrint Archive, Report 2019\/1273. 2019. IACR https:\/\/ia.cr\/2019\/1273"},{"key":"9398_CR64","unstructured":"L. Knudsen, DEAL\u2014a 128-bit block cipher (1998)"},{"key":"9398_CR65","unstructured":"\u00d6. K\u00fc\u00e7\u00fck, The hash function Hamsi. Submission to NIST (Round 2) (2009). https:\/\/www.esat.kuleuven.be\/cosic\/publications\/article-1203.pdf"},{"key":"9398_CR66","unstructured":"R. Kumar Pal, Implementation and evaluation of authenticated encryption algorithms on Java Card Platform (master\u2019s thesis). Master\u2019s Thesis (2017). https:\/\/is.muni.cz\/th\/448415\/fi_m\/MSThesis_IS.pdf"},{"key":"9398_CR67","doi-asserted-by":"publisher","unstructured":"Z. Li, X. Dong, X. Wang, Conditional cube attack on round-reduced ASCON. IACR Trans. Symmetric Cryptol. 2017(1), 175\u2013202 (2017). https:\/\/doi.org\/10.13154\/tosc.v2017.i1.175-202. IACR: https:\/\/ia.cr\/2017\/160, https:\/\/github.com\/lizhengcn\/Ascon_test","DOI":"10.13154\/tosc.v2017.i1.175-202"},{"key":"9398_CR68","doi-asserted-by":"publisher","unstructured":"L. Lerman, O. Markowitch, N. Veshchikov, Comparing Sboxes of ciphers from the perspective of side-channel attacks, in Asian-HOST 2016 (IEEE Computer Society, 2016), pp. 1\u20136. https:\/\/doi.org\/10.1109\/AsianHOST.2016.7835556. IACR https:\/\/ia.cr\/2016\/993","DOI":"10.1109\/AsianHOST.2016.7835556"},{"issue":"1","key":"9398_CR69","doi-asserted-by":"publisher","first-page":"74","DOI":"10.13154\/tosc.v2018.i1.74-100","volume":"2018","author":"G Leander","year":"2018","unstructured":"G. Leander, C. Tezcan, F. Wiemer, Searching for subspace trails and truncated differentials. IACR Trans. Symmetric Cryptol. 2018(1), 74\u2013100 (2018). https:\/\/doi.org\/10.13154\/tosc.v2018.i1.74-100","journal-title":"IACR Trans. Symmetric Cryptol."},{"issue":"3","key":"9398_CR70","doi-asserted-by":"publisher","first-page":"38102","DOI":"10.1007\/s11432-016-0283-3","volume":"60","author":"Y Li","year":"2017","unstructured":"Y. Li, G. Zhang, W. Wang, M. Wang, Cryptanalysis of round-reduced ASCON. Sci. China Inf. Sci. 60(3), 38102 (2017). https:\/\/doi.org\/10.1007\/s11432-016-0283-3","journal-title":"Sci. China Inf. Sci."},{"key":"9398_CR71","unstructured":"National Institute of Standards and Technology, FIPS PUB 180-2: secure hash standard. Federal Information Processing Standards Publication 180-2, U.S. Department of Commerce (2002)"},{"key":"9398_CR72","doi-asserted-by":"publisher","unstructured":"National Institute of Standards and Technology, FIPS PUB 180-4: Secure hash standard. Federal Information Processing Standards Publication 180-4, U.S. Department of Commerce. 2015. https:\/\/doi.org\/10.6028\/NIST.FIPS.180-4","DOI":"10.6028\/NIST.FIPS.180-4"},{"key":"9398_CR73","doi-asserted-by":"publisher","unstructured":"National Institute of Standards and Technology, NIST SP 800-185: SHA-3 derived functions: cSHAKE, KMAC, TupleHash, ParallelHash. NIST Special Publication 800-185, U.S. Department of Commerce (2016). https:\/\/doi.org\/10.6028\/NIST.SP.800-185","DOI":"10.6028\/NIST.SP.800-185"},{"key":"9398_CR74","unstructured":"National Institute of Standards and Technology. Submission requirements and evaluation criteria for the lightweight cryptography standardization process (2018). https:\/\/csrc.nist.gov\/CSRC\/media\/Projects\/Lightweight-Cryptography\/documents\/final-lwc-submission-requirements-august2018.pdf"},{"issue":"2","key":"9398_CR75","doi-asserted-by":"publisher","first-page":"292","DOI":"10.1007\/s00145-010-9085-7","volume":"24","author":"S Nikova","year":"2011","unstructured":"S. Nikova, V. Rijmen, M. Schl\u00e4ffer, Secure hardware implementation of nonlinear functions in the presence of glitches. J. Cryptol. 24(2), 292\u2013321 (2011). https:\/\/doi.org\/10.1007\/s00145-010-9085-7","journal-title":"J. Cryptol."},{"key":"9398_CR76","unstructured":"NIST LWC Software Performance Benchmarks on Microcontrollers. https:\/\/lwc.las3.de\/ (visited on 06\/24\/2020)"},{"key":"9398_CR77","doi-asserted-by":"publisher","unstructured":"K. Ramezanpour, P. Ampadu, W. Diehl, A statistical fault analysis methodology for the Ascon authenticated cipher, in HOST 2019 (IEEE, 2019), pp. 41\u201350. https:\/\/doi.org\/10.1109\/HST.2019.8741029","DOI":"10.1109\/HST.2019.8741029"},{"key":"9398_CR78","doi-asserted-by":"publisher","unstructured":"K. Ramezanpour, P. Ampadu, W. Diehl, FIMA: fault intensity map analysis, in COSADE 2019. LNCS, vol. 11421 (Springer, 2019), pp. 63\u201379. https:\/\/doi.org\/10.1007\/978-3-030-16350-1-5","DOI":"10.1007\/978-3-030-16350-1-5"},{"key":"9398_CR79","unstructured":"K. Ramezanpour, P. Ampadu, W. Diehl, SCARL: side-channel analysis with reinforcement learning on the Ascon authenticated cipher. CoRR. arXiv:2006.03995"},{"key":"9398_CR80","unstructured":"B. Rezvani, W. Diehl, Hardware implementations of NIST lightweight cryptographic candidates: a first look. IACR Cryptology ePrint Archive, Report 2019\/824 (2019). IACR https:\/\/ia.cr\/2019\/824"},{"key":"9398_CR81","unstructured":"S. Renner, E. Pozzobon, J. Mottok, Benchmarking software implementations of 1st round candidates of the NIST LWC project on MCUs, in NIST Lightweight Cryptography Workshop (2019). https:\/\/csrc.nist.gov\/Presentations\/2019\/benchmarking-software-implementations-of-1st-round"},{"issue":"1","key":"9398_CR82","doi-asserted-by":"publisher","first-page":"75","DOI":"10.1007\/s13389-015-0114-1","volume":"6","author":"M-JO Saarinen","year":"2016","unstructured":"M.-J.O. Saarinen, The BRUTUS automatic cryptanalytic framework\u2014Testing CAESAR authenticated encryption candidates forweaknesses. J. Cryptogr. Eng. 6(1), 75\u201382 (2016). https:\/\/doi.org\/10.1007\/s13389-015-0114-1","journal-title":"J. Cryptogr. Eng."},{"key":"9398_CR83","doi-asserted-by":"publisher","unstructured":"N. Samwel, J. Daemen, DPAon hardware implementations of Ascon and Keyak, in CF\u201917 (ACM, 2017), pp. 415\u2013424. https:\/\/doi.org\/10.1145\/3075564.3079067","DOI":"10.1145\/3075564.3079067"},{"key":"9398_CR84","doi-asserted-by":"publisher","unstructured":"N. Samir, A.S. Hussein, M. Khaled, A.N. El-Zeiny, M. Osama, H. Yassin, A. Abdelbaky, O. Mahmoud, A. Shawky, H. Mostafa, ASIC and FPGA comparative study for IoT lightweight hardware security algorithms. J. Circuits Syst. Comput. 28(12), 1930009:1\u20131930009:25 (2019). https:\/\/doi.org\/10.1142\/S0218126619300095","DOI":"10.1142\/S0218126619300095"},{"key":"9398_CR85","doi-asserted-by":"publisher","unstructured":"K. Stoffelen, Optimizing s-box implementations for several criteria using SAT solvers, in FSE 2016. LNCS, vol. 9783 (Springer, 2016), pp. 140\u2013160. https:\/\/doi.org\/10.1007\/978-3-662-52993-5-8. IACR https:\/\/ia.cr\/2016\/198","DOI":"10.1007\/978-3-662-52993-5-8"},{"key":"9398_CR86","doi-asserted-by":"publisher","unstructured":"Y. Sasaki, K. Yasuda, How to incorporate associated data in sponge-based authenticated encryption, in CT-RSA 2015. LNCS, vol. 9048 (Springer, 2015), pp. 353\u2013370. https:\/\/doi.org\/10.1007\/978-3-319-16715-2-19","DOI":"10.1007\/978-3-319-16715-2-19"},{"key":"9398_CR87","unstructured":"The CAESAR committee, CAESAR: competition for authenticated encryption: security, applicability, and robustness (2014). https:\/\/competitions.cr.yp.to\/caesar-submissions.html"},{"key":"9398_CR88","doi-asserted-by":"publisher","unstructured":"M. Tempelmeier, F. De Santis, G. Sigl, J.-P. Kaps, The CAESAR-API in the real world\u2014towards a fair evaluation of hardware CAESAR candidates, in HOST 2018 (IEEE Computer Society, 2018), pp. 73\u201380. https:\/\/doi.org\/10.1109\/HST.2018.8383893","DOI":"10.1109\/HST.2018.8383893"},{"key":"9398_CR89","doi-asserted-by":"publisher","unstructured":"C. Tezcan, Truncated, impossible, and improbable differential analysis of Ascon, in ICISSP 2016 (SciTePress, 2016), pp. 325\u2013332. https:\/\/doi.org\/10.5220\/0005689903250332. IACR https:\/\/ia.cr\/2016\/490","DOI":"10.5220\/0005689903250332"},{"key":"9398_CR90","unstructured":"C. Tezcan, Distinguishers for reduced round Ascon, DryGASCON, and Shamash permutations, in NIST Lightweight Cryptography Workshop (2019). https:\/\/csrc.nist.gov\/Presentations\/2019\/distinguishers-forreduced-round-ascon-drygascon-a"},{"key":"9398_CR91","doi-asserted-by":"publisher","unstructured":"Y. Todo, Structural evaluation by generalized integral property, in EUROCRYPT 2015. LNCS, vol. 9056 (Springer, 2015), pp. 287\u2013314. https:\/\/doi.org\/10.1007\/978-3-662-46800-5-12. IACR https:\/\/ia.cr\/2015\/090","DOI":"10.1007\/978-3-662-46800-5-12"},{"key":"9398_CR92","doi-asserted-by":"publisher","unstructured":"S. Vaudenay, D. Viz\u00e1r, Can Caesar beat Galois?\u2014Robustness of CAESAR candidates against nonce reusing and high data complexity attacks, in ACNS 2018. LNCS, vol. 10892 (Springer, 2018), pp. 476\u2013494. https:\/\/doi.org\/10.1007\/978-3-319-93387-0-25. IACR https:\/\/ia.cr\/2017\/1147","DOI":"10.1007\/978-3-319-93387-0-25"},{"key":"9398_CR93","doi-asserted-by":"publisher","unstructured":"P. Yalla, J.-P. Kaps, Evaluation of the CAESAR hardware API for lightweight implementations, in ReConFig 2017 (IEEE, 2017), pp. 1\u20136. https:\/\/doi.org\/10.1109\/RECONFIG.2017.8279790 (p. 33)","DOI":"10.1109\/RECONFIG.2017.8279790"},{"issue":"5","key":"9398_CR94","doi-asserted-by":"publisher","first-page":"469","DOI":"10.1049\/iet-ifs.2018.5263","volume":"13","author":"H Yan","year":"2019","unstructured":"H. Yan, X. Lai, L. Wang, Y. Yu, Y. Xing, New zero-sum distinguishers on full 24-round Keccak-f using the division property, in IET Information Security 13.5 (2019), pp. 469\u2013478. https:\/\/doi.org\/10.1049\/iet-ifs.2018.5263","journal-title":"IET Information Security"},{"key":"9398_CR95","unstructured":"R. Zong, X. Dong, X. Wang, Collision attacks on round-reduced Gimli-Hash\/Ascon-Xof\/Ascon-Hash. IACR Cryptology ePrint Archive, Report 2019\/1115 (IACR, 2019), p. 21. https:\/\/ia.cr\/2019\/1115"}],"container-title":["Journal of Cryptology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s00145-021-09398-9.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s00145-021-09398-9\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s00145-021-09398-9.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,9,2]],"date-time":"2024-09-02T07:04:40Z","timestamp":1725260680000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s00145-021-09398-9"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,6,22]]},"references-count":95,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2021,7]]}},"alternative-id":["9398"],"URL":"https:\/\/doi.org\/10.1007\/s00145-021-09398-9","relation":{},"ISSN":["0933-2790","1432-1378"],"issn-type":[{"value":"0933-2790","type":"print"},{"value":"1432-1378","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,6,22]]},"assertion":[{"value":"2 December 2019","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"28 September 2020","order":2,"name":"revised","label":"Revised","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"28 September 2020","order":3,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"22 June 2021","order":4,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}],"article-number":"33"}}