From Authenticated Encryption to Hash: A Comprehensive Design Space Exploration of the NIST Standard Ascon Family

Ascon is the National Institute of Standards and Technology (NIST) standard for lightweight cryptography, providing Authenticated Encryption with Associated Data (AEAD), hash, eXtendable-Output Function (XOF), and Customizable XOF (CXOF). Prior studies mainly target AEAD implementations of earlier Ascon versions with a little focus on hash and unified designs, and generally explore the area and latency tradeoff by varying permutation rounds per one clock cycle. In this work, we present a comprehensive design space exploration of the complete Ascon family of the NIST standard for the first time through two design architectures: (i) the conventional round-based variants that perform 1, 2, and 4 rounds per one clock cycle, i.e., v1r1c, v2r1c, and v4r1c, respectively, and (ii) the operation-based variants that execute one 64-bit and 32-bit operation per one clock cycle using a cycle-optimized schedule that completes one permutation round with a total of 28 and 56 cycles, i.e., v1op1c_64b_28 and v1op1c_32b_56, respectively. Our design space exploration includes the Ascon-AEAD128 encryption, decryption, unified encryption/decryption, unified Ascon-Hash256, Ascon-XOF128, Ascon-CXOF128, and a complete Ascon unified family. Experimental results show that the round-based variants achieve low latency and energy consumption, while the operation-based variants lead to designs with low area. Our implementations also have smaller hardware complexity than the state-of-the-art designs. For example, on the Ascon-AEAD128 designs performing encryption, our round-based v1r1c variant achieves an area reduction of when compared to a round-based state-of-the-art design, while our v1op1c_64b_28 variant reduces latency and energy consumption by and, respectively when compared to the state-of-the-art design using one 64-bit operation per one clock cycle, completing one permutation round in 59 clock cycles.