The cipher suite Ascon v1.2 already provides authenticated encryption schemes, hash, and extendable output functions. Furthermore, the underlying permutation is also used in two instances of Isap v2.0, an authenticated encryption scheme designed to provide enhanced robustness against side-channel and fault attacks. In this paper, we enrich the functionality one can get out of Ascon\u27s permutation by providing efficient Pseudorandom Functions (PRFs), a Message Authentication Code (MAC) and a fast short-input PRF for messages up to 128 bits

Christoph Dobraunig

Florian Mendel

Maria Eichlseder

Martin Schläffer

Cryptology ePrint Archive

Ascon PRF, MAC, and Short-Input MACChristoph Dobraunig3,4, Maria Eichlseder1, Florian Mendel2,and Martin Schläffer21Graz University of Technology, Austria2Infineon Technologies AG, Germany3Intel Labs, USA4Lamarr Security Research, Austriahttps://ascon.iaik.tugraz.atThe cipher suite Ascon v1.2 already provides authenticated encryp-tion schemes, hash, and extendable output functions. Furthermore, theunderlying permutation is also used in two instances of Isap v2.0, anauthenticated encryption scheme designed to provide enhanced robust-ness against side-channel and fault attacks. In this paper, we enrichthe functionality one can get out of Ascon’s permutation by providingefficient Pseudorandom Functions (PRFs), a Message AuthenticationCode (MAC) and a fast short-input PRF for messages up to 128 bits.Keywords: Pseudorandom function ·MAC · Ascon.1 IntroductionThe Ascon family of authenticated encryption schemes [DEMS14] was first pub-lished in the beginning of 2014 as a submission to the CAESARCompetition [Cae14].After 5 years of public scrutiny, the authenticated encryption schemesAscon-128 andAscon-128a (v1.2) [DEMS16] were recommended as the first choice for lightweightapplications in the final portfolio of CAESAR for resource-constrained environ-ments. Furthermore, the cipher suite Ascon v1.2 [DEMS21a; DEMS21b] containingAscon-128 and Ascon-128a, as well as the hash function Ascon-Hash and extend-able output function Ascon-Xof, are finalists in the NIST lightweight cryptography(LWC) standardization process [Nat18]. Ascon’s permutation also serves as a basisfor two instances of Isap v2.0 [DEM+20; DEM+21], an authenticated encryptionscheme designed to provide enhanced robustness against side-channel and faultattacks on algorithmic level. Isap v2.0 is also a NIST LWC finalist.In this paper, we define two lightweight and efficient pseudorandom function (PRF)families, Ascon-Prf and Ascon-PrfShort. Ascon-Prf processes inputs of arbitrary1length and produces outputs of length up to 232 bits. In contrast, Ascon-PrfShortoperates only on short inputs ≤ 128 bits producing outputs of short length ≤ 128bits. Ascon-Prf and Ascon-PrfShort are adaptions of the full-keyed sponge (FKS)mode [BDPV07; BDPV12; MRV15; DMV17]. Ascon-Prf uses a rate of 256 bitsduring absorption and a rate of 128 bits in the squeezing phase. Overall, Ascon-Prfis an efficient choice for general-purpose lightweight message authentication, so wedefine the correspondingmessage authentication code (MAC)Ascon-Mac based onAscon-Prf. Ascon-PrfShort excels whenever short data needs to be authenticated,e.g., the authentication of pointers, in challenge-response protocols, or protocolsthat derive symmetric keys of entities from a master key.2 SpecificationIn this section, we introduce the state layout and notation for our functions andspecify the modes of operation for the PRFs and the MAC.2.1 State and NotationOur algorithms operate on a 320-bit state S which is updated using the a-roundpermutation pa. The state S is divided into an outer part of r bits and an inner partof c bits, where the rate r and capacity c = 320− r depend on the variant.For the description and application of the round transformations (Section 3), the320-bit state S is split into five 64-bit words xi, as illustrated in Figure 3a:S = x0 ∥ x1 ∥ x2 ∥ x3 ∥ x4 .Whenever S needs to be interpreted as a byte-array (or bitstring) used in the spongeinterface, the array starts with the most significant byte (or bit) of x0 as byte 0 andends with the least significant byte (or bit) of x4 as byte 39. Table 1 lists the notation.2.2 AlgorithmsPseudorandom functions. Ascon-Prf is parameterized by the key length of k bits,output rate of r bits, internal round number a, and maximum output length of0 < t < 232 bits (or t = 0 for unlimited output). The algorithm Gk,r,a,t takes as itsinput a secret key K with k bits, input data M of arbitrary length, and a requestedoutput length ℓ ≤ t. It returns an output T of size ℓ bits:Gk,r,a,t(K, M, ℓ) = T .Ascon-PrfShort is parameterized by the key length k bits, input length m ≤ 128bits, internal round number a, and output size t ≤ 128 bits. The algorithm Fk,m,a,ttakes as its input a secret key K with k bits and some input data M of m bits. Itproduces an output T of size t bits:Fk,m,a,t(K, M) = T .2Table 1: Notation used for Ascon’s interface, mode, and permutationK Secret key K of k ≤ 128 bitsM, D, T Message M, data D, output/tag T (in r-bit blocks Mi, Di, Ti)S The 320-bit state S of the sponge constructionp, pa Permutation paconsisting of a update rounds px ∈ {0, 1}k Bitstring x of length k (variable if k = ∗)0k Bitstring of k bits (variable length if k = ∗), all 0|x| Length of the bitstring x in bits⌊x⌋k Bitstring x truncated to the first (most significant) k bits⌈x⌉k Bitstring x truncated to the last (least significant) k bitsx ∥ y Concatenation of bitstrings x and yx⊕ y Xor of bitstrings x and yx mod y Remainder in integer division of x by y⌈x⌉ Ceiling function, smallest integer larger than xpC, pS, pL constant-addition, substitution and linear layer of p = pL ◦ pS ◦ pCx0, . . . , x4 The five 64-bit words of the state Sx0,i, . . . , x4,i Bit i, 0 ≤ i < 64, of words x0, . . . , x4, with x·,0 the rightmost bit (LSB)x⊕ y Bitwise xor of 64-bit words or bits x and yx⊙ y Bitwise and of 64-bit words or bits x and y (denoted x y in the ANF)x ≫ i Right-rotation (circular shift) by i bits of 64-bit word xMessage authentication. Ascon-Mac is parameterized by the key length k bits,output rate r, internal round number a, and tag length t. It specifies an authentica-tion algorithm Ak,r,a,t and a verification algorithm Vk,r,a,t, both calling Gk,r,a,t. Theauthentication algorithm Ak,r,a,t takes as its input a secret key K with k bits and amessage M of arbitrary length. It produces a tag T of length t as its output:Ak,r,a,t(K, M) = T .The verification procedure Vk,r,a,t takes as input the key K, message M and tag T,and outputs either pass if the verification of the tag is correct or fail if it fails:Vk,r,a,t(K, M, T) ∈ {pass, fail} .2.3 Recommended Parameter SetsTable 2 lists our recommended instances for PRFs. Table 2 shows our recommendedinstance for the MAC and specifies its parameters, including the key size k, the rater, the maximum tag length t, and the number of rounds a for the permutation pa.2.4 Arbitrary-Length Pseudorandom FunctionsThe mode of operation of Ascon-Prf is based on full-state keyed sponge modes[BDPV07] such as the DonkeySponge [BDPV12] mode. The PRF is illustrated inFigure 1 and specified in Algorithm 1.3Table 2: Parameters for recommended Pseudorandom Functions (PRF) andMes-sage Authentication Codes (MAC). Unlimited input/output lengths (‘un-lim.’) are implicitly limited by the security claim to ≤ 272 bits.Name Algorithms Bit size of Roundskey data (block) output (block) pak m t r aAscon-Mac A,V128,128,12,128 128 unlim. 256 128 128 12Ascon-Prf G128,128,12,0 128 unlim. 256 unlim. 128 12Ascon-PrfShort F128,∗,12,∗ 128 ≤ 128 128 ≤ 128 128 12IV∥K∥0∗paInitializationM1256pa64Ms−1256pa64Absorb MessageMs256640∗∥1paT1rpacT⌈ℓ/r⌉−1rpacT⌈ℓ/r⌉rFigure 1: Pseudorandom Function Gk,r,a,t with output length ℓ (ℓ ≤ t or t = 0).2.4.1 InitializationThe 320-bit initial state of Ascon is formed by the secret key K of k bits and anIV specifying the algorithm. The 64-bit IV of Ascon-Prf specifies the algorithmparameters in a similar format as for Ascon, including k and the rate r each writtenas an 8-bit integer and round number a encoded as an 8-bit integer as 27 + a = 80⊕ a,followed by the maximum output length of t bits as a 32-bit integer, or t = 0 forarbitrarily long output:IVk,r,a,t ← k ∥ r ∥(1∥07)⊕ a ∥ 08 ∥ tS← IVk,r,a,t ∥K ∥ 0256−kIn the initialization, the a-round permutation pa is applied to the initial state:S← pa(S)2.4.2 Absorb MessageThe PRF processes the padded message M, in blocks of 256 bits. The paddingprocess appends a single 1 and the smallest number of 0s to M such that the lengthof the padded message is a multiple of 256 bits. The resulting padded message issplit into s blocks of 256 bits, M1 ∥ . . . ∥Ms:M1, . . . , Ms ← 256-bit blocks of M ∥ 1 ∥ 0255−(|M|mod 256)4Algorithm 1: PRFPRF Gk,r,a,t(K, M, ℓ) = TInput: key K ∈ {0, 1}k, input M ∈ {0, 1}∗, output bitsize ℓ ≤ t or ℓ arbitrary if t = 0Output: output T ∈ {0, 1}ℓInitializationS← pa(IVk,r,a,t ∥K ∥ 0256−k)AbsorbingM1 . . . Ms ← 256-bit blocks of M∥1∥0∗for i = 1, . . . , s− 1 doS← pa(S⊕ (Mi ∥ 064))S← pa(S⊕ (Ms ∥ 063 ∥ 1))Squeezingu=⌈ℓ/r⌉for i = 1, . . . , u− 1 doTi ← ⌊S⌋rS← pa(S)Tu ← ⌊S⌋rreturn ⌊T1 ∥ . . . ∥ Tu⌋ℓThe message blocks Mi with i = 1, . . . , s− 1 are processed as follows. Each blockMi is xored to the state S, followed by an application of the a-round permutation pato S. For the last message block Ms a single 1 is xored to the state in addition to themessage block:S←{pa(S⊕ (Mi ∥ 064)) if 1 ≤ i ≤ s− 1pa(S⊕ (Mi ∥ 063 ∥ 1)) if i = s2.4.3 Squeeze TagThen the output is extracted from the state in r-bit blocks Ti until the requestedoutput length ℓ ≤ t (or ℓ arbitrary if t = 0) is completed after u = ⌈ℓ/r⌉ blocks.After each extraction (except the last one), the internal state S is transformed by thea-round permutation pa:Ti ← ⌊S⌋rS← pa(S), 1 ≤ i ≤ u = ⌈t/r⌉The last output block Tu is truncated to ℓ mod r bits and ⌊T1 ∥ . . . ∥ Tu⌋ℓ is returned.2.5 Message authenticationThemessage authentication codeAscon-Macmainly relays inputs to the underlyingPRF algorithm Gk,r,a,t and, for verification, checks if the transmitted tag T matchesthe computed tag T∗. The MAC is specified in Algorithm 2.5Algorithm 2: Authentication and verification proceduresAuthenticationAk,r,a,t(K, M)Input: key K ∈ {0, 1}k, k ≤ 128,message M ∈ {0, 1}∗Output: tag T ∈ {0, 1}tT ← Gk,r,a,t(K, M, t)return TVerificationVk,r,a,t(K, M, T)Input: key K ∈ {0, 1}k, k ≤ 128,message M ∈ {0, 1}∗,tag T ∈ {0, 1}tOutput: pass or failT∗ ← Gk,r,a,t(K, M, t)if T = T∗ return passelse return fail2.6 Short-Input Pseudorandom FunctionsThemode of operation ofAscon-PrfShort is essentially the initialization ofAscon-128with a different initial value, and the nonce replaced by a single message block Mof length m ≤ 128 bits. The resulting PRF Ascon-PrfShort is illustrated in Figure 2and specified in Algorithm 3.IV∥K∥M∥0∗paKT128Figure 2: PRF Fk,m,a,t for short inputsAlgorithm 3: Short-input PRF. In an implementation, m and t can be inputs (insteadof parameters).PRF Fk,m,a,t(K, M) = TInput: key K ∈ {0, 1}k, k ≤ 128,input M ∈ {0, 1}m, m ≤ 128Output: output T ∈ {0, 1}tS← pa(IVk,m,a,t ∥K ∥M ∥ 0256−k−m)T ← ⌈S⌉t ⊕ ⌈K⌉treturn TAs shown in Algorithm 3, the 320-bit input to pa is formed by an IV specifying thealgorithm, the secret key K of k bits, and the message M of m bits. The 64-bit IV ofFk,m,a,t includes the key length k, the size of the input block m, and the size of theoutput block t, each written as an 8-bit integer, and the round number a encoded as6an 8-bit integer as 26 + a = 40⊕ a:IVk,m,a,t ← k ∥m ∥(0∥1∥06)⊕ a ∥ t ∥ 032This IV is concatenated with the secret key K and the message M. Note that nopadding is applied to M and hence, Fk,m,a,t only accepts M matching the length m.The permutation pa is applied to this state:S← pa(IVk,m,a,t ∥K ∥M ∥ 0256−k−m)The last t bits of the state are then extracted as the tag T. The additional xor withthe key K is performed similarly to the authenticated encryption schemes:T ← ⌈S⌉t ⊕ ⌈K⌉t3 PermutationThe main component of the PRFs is the 320-bit permutation pa. The permutationiteratively applies an SPN-based round transformation p that in turn consists ofthree steps; pC, pS, pL:p = pL ◦ pS ◦ pC .The number of rounds a is a tunable security parameter.For the description and application of the round transformations, the 320-bit state Sis split into five 64-bit words xi as follows: S = x0 ∥ x1 ∥ x2 ∥ x3 ∥ x4 (see Figure 3).x0x1x2x3x4(a) Round constant addition pCx0x1x2x3x4(b) Substitution layer pS with 5-bit S-box S(x)x0x1x2x3x4(c) Linear layer with 64-bit diffusion functions Σi(xi)Figure 3: The five 64-bit words of the 320-bit state S and operations pL ◦ pS ◦ pC.7x0x1x2x3x4111111x0x1x2x3x4(a) Ascon’s 5-bit S-box S(x)x0 ← Σ0(x0) = x0 ⊕ (x0 ≫ 19)⊕ (x0 ≫ 28)x1 ← Σ1(x1) = x1 ⊕ (x1 ≫ 61)⊕ (x1 ≫ 39)x2 ← Σ2(x2) = x2 ⊕ (x2 ≫ 1)⊕ (x2 ≫ 6)x3 ← Σ3(x3) = x3 ⊕ (x3 ≫ 10)⊕ (x3 ≫ 17)x4 ← Σ4(x4) = x4 ⊕ (x4 ≫ 7)⊕ (x4 ≫ 41)(b) Ascon’s linear layer with 64-bit functions Σi(xi)Figure 4: Ascon’s substitution layer and linear diffusion layer.3.1 Addition of ConstantsThe constant addition step pC adds a round constant cr to word x2 of the state S inround i (see Figure 3a). Both indices r and i start from zero and we use r = i for pa(see Table 3):x2 ← x2 ⊕ cr .Table 3: The round constants cr used in each round i of pa.p12 Constant cr p12 Constant cr0 00000000000000f0 6 00000000000000961 00000000000000e1 7 00000000000000872 00000000000000d2 8 00000000000000783 00000000000000c3 9 00000000000000694 00000000000000b4 10 000000000000005a5 00000000000000a5 11 000000000000004b3.2 Substitution LayerThe substitution layer pS updates the state S with 64 parallel applications of the5-bit S-box S(x), defined in Figure 4a, to each bit-slice of the five words x0 . . . x4(Figure 3b). The S-box is typically implemented in bitsliced form with operationsperformed on the entire 64-bit words. The lookup table of S is given in Table 4,where x0 is the MSB and x4 the LSB.Table 4: Ascon’s 5-bit S-box S as a lookup table.x 0 1 2 3 4 5 6 7 8 9 a b c d e f 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1fS(x) 4 b 1f 14 1a 15 9 2 1b 5 8 12 1d 3 6 1c 1e 13 7 e 0 d 11 18 10 c 1 19 16 a f 1783.3 Linear Diffusion LayerThe linear diffusion layer pL provides diffusionwithin each 64-bitword xi (Figure 3c).It applies a linear function Σi(xi) defined in Figure 4b to each word xi:xi ← Σi(xi), 0 ≤ i ≤ 4 .4 Security ClaimAscon-Prf, Ascon-PrfShort, and Ascon-Mac are designed to help provide 128-bit security against key recovery and min(128, t) security against guessing T for arandom key and newly queried M. The number of message blocks processed bythe algorithms is limited to a total of 264 blocks per key. We consider this as morethan sufficient for lightweight applications in practice.It is beneficial that a system or protocol implementing theMAC algorithmsmonitorsand, if necessary, limits the number of tag verification failures per key. After reachingthis limit, the verification rejects all tags.We emphasize that we do not require ideal properties for the permutation pa. Non-random properties of the permutation pa are known and are unlikely to affect theclaimed security properties of the algorithm.5 Software PerformanceA preliminary overview of the software performance of Ascon-Mac, Ascon-Prfand Ascon-PrfShort is given in Table 5a and Table 5b in comparison with Table 5cand Table 5d.Acknowledgments. The authorswould like to thank all researchers contributing tothe design, analysis, and implementation of Ascon. In particular, we want to thankHannes Gross and Robert Primas for all their support and various implementationsof Ascon. Furthermore, we want to thank Bart Mennink for giving feedback on thisdocument.Part of this work has been supported by the Austrian Science Fund (FWF): P26494-N15 and J 4277-N38, by the European Union’s Horizon 2020 research and innovationprogramme (H2020 ICT 644052: HECTOR), and by the Austrian Government(FFG/SFG COMET 836628: SeCoS and FIT-IT 835919: SePAG).9Table 5: Software performance in cycles per byte of Ascon-Mac, Ascon-Prf andAscon-PrfShort compared to Ascon and Ascon-128a.(a) Ascon-Mac and Ascon-PrfMessage Length 1 8 16 32 64 1536 longIntel® Core™ i5-6300U 427 48 24 21 13.3 6.4 6.2Intel® Core™ i5-4200U 517 64 33 25 16.3 8.7 8.4ARM1176JZF-S (ARMv6) 1803 237 123 89 60.1 33.1 33.4(b) Ascon-PrfShortMessage Length 1 8 16Intel® Core™ i5-6300U 188 23 12Intel® Core™ i5-4200U 257 33 17ARM1176JZF-S (ARMv6) 1098 136 72(c) Ascon-128Message Length 1 8 16 32 64 1536 longIntel® Core™ i5-6300U 367 58 35 23 17.6 11.9 11.4Intel® Core™ i5-4200U 521 81 49 32 23.9 16.2 15.8ARM1176JZF-S (ARMv6) 2136 312 186 123 91.6 61.8 62.2(d) Ascon-128aMessage Length 1 8 16 32 64 1536 longIntel® Core™ i5-6300U 365 47 31 19 13.5 8.0 7.8Intel® Core™ i5-4200U 519 67 44 27 18.8 11.0 10.6ARM1176JZF-S (ARMv6) 2118 261 170 107 75.6 46.0 46.6Bibliography[BDPV07] Guido Bertoni, Joan Daemen, Michaël Peeters, and Gilles Van Assche.“Sponge functions”. Ecrypt Hash Workshop 2007. 2007. url: http://sponge.noekeon.org/SpongeFunctions.pdf (pp. 2, 3).[BDPV12] Guido Bertoni, Joan Daemen, Michaël Peeters, and Gilles Van Assche.“Permutation-based Encryption, Authentication and AuthenticatedEncryption”. DIAC 2012. July 2012 (pp. 2, 3).[Cae14] The CAESAR committee. “CAESAR: Competition for AuthenticatedEncryption: Security, Applicability, and Robustness”. 2014. url: https://competitions.cr.yp.to/caesar-submissions.html (p. 1).[DEM+20] Christoph Dobraunig, Maria Eichlseder, Stefan Mangard, FlorianMendel, Bart Mennink, Robert Primas, and Thomas Unterluggauer.“Isap v2.0”. In: IACR Transactions on Symmetric Cryptology 2020.S1(2020), pp. 390–416. doi: 10.13154/tosc.v2020.iS1.390-416 (p. 1).10[DEM+21] Christoph Dobraunig, Maria Eichlseder, Stefan Mangard, FlorianMendel, Bart Mennink, Robert Primas, and Thomas Unterluggauer.“Isap v2.0 (Submission to NIST)”. Finalist of NIST lightweight cryp-tography standardization process, https://csrc.nist.gov/Projects/Lightweight-Cryptography/. 2021 (p. 1).[DEMS14] Christoph Dobraunig, Maria Eichlseder, Florian Mendel, and MartinSchläffer. “Ascon v1”. Submission to the CAESAR competition. 2014.url: https://ascon.iaik.tugraz.at (p. 1).[DEMS16] Christoph Dobraunig, Maria Eichlseder, Florian Mendel, and Mar-tin Schläffer. “Ascon v1.2”. Submission to Round 3 of the CAESARcompetition. 2016. url: https://ascon.iaik.tugraz.at (p. 1).[DEMS21a] Christoph Dobraunig, Maria Eichlseder, Florian Mendel, and Mar-tin Schläffer. “Ascon v1.2 (Submission to NIST)”. Finalist of NISTlightweight cryptography standardization process, https://csrc.nist.gov/Projects/Lightweight-Cryptography/. 2021 (p. 1).[DEMS21b] Christoph Dobraunig, Maria Eichlseder, Florian Mendel, and MartinSchläffer. “Ascon v1.2: Lightweight Authenticated Encryption andHashing”. In: Journal of Cryptology 34.3 (2021), p. 33. doi: 10.1007/s00145-021-09398-9. url: https://doi.org/10.1007/s00145-021-09398-9 (p. 1).[DMV17] JoanDaemen, BartMennink, andGilles VanAssche. “Full-State KeyedDuplex with Built-In Multi-user Support”. In: ASIACRYPT 2017. Vol.10625. LNCS. Springer, 2017, pp. 606–637. doi: 10.1007/978-3-319-70697-9_21. iacr: 2017/498 (p. 2).[MRV15] Bart Mennink, Reza Reyhanitabar, and Damian Vizár. “Security ofFull-State Keyed Sponge and Duplex: Applications to AuthenticatedEncryption”. In: ASIACRYPT 2015. Vol. 9453. LNCS. Springer, 2015,pp. 465–489. doi: 10.1007/978-3-662-48800-3_19 (p. 2).[Nat18] National Institute of Standards and Technology. “Submission Re-quirements and Evaluation Criteria for the Lightweight Cryptog-raphy Standardization Process”. https : / / csrc . nist . gov / CSRC /media/Projects/Lightweight-Cryptography/documents/final-lwc-submission-requirements-august2018.pdf. 2018 (p. 1).11

Ascon PRF, MAC, and Short-Input MAC

Abstract

Similar works

Full text

Available Versions

Cryptology ePrint Archive