A from-scratch implementation of Ascon-AEAD128, the authenticated encryption algorithm selected by NIST in 2023 as the standard for lightweight cryptography. Written in Magma, this project was developed as a group project as part of a cryptography course in the MSc Mathematics program.
Ascon is a family of lightweight cryptographic algorithms designed for constrained environments such as embedded systems, IoT devices, and hardware accelerators. In 2023, NIST selected Ascon as the winner of the Lightweight Cryptography Standardization process, making it the official standard for lightweight authenticated encryption.
This implementation covers Ascon-AEAD128, which provides:
- Confidentiality — the plaintext is encrypted and unreadable without the key
- Integrity — any tampering with the ciphertext is detected
- Authenticity — the receiver can verify that the message was produced by someone who holds the key
This combination is known as Authenticated Encryption with Associated Data (AEAD), the same paradigm used in TLS 1.3, Signal, and WhatsApp.
Ascon is a sponge-based construction built on a 320-bit internal state divided into five 64-bit words S₀, S₁, S₂, S₃, S₄.
K (128 bit) N (128 bit)
│ │
IV ───────┴───────────────┘
│
┌────▼─────┐
│ Ascon-p │ ← 12 rounds (initialization)
│ (p¹²) │
└────┬─────┘
│ ⊕ K
│
┌────▼──────────────┐
│ Associated Data │ ← 8 rounds per 128-bit block (p⁸)
└────┬──────────────┘
│ ⊕ 1 (domain separation)
│
┌────▼──────────────┐
│ Plaintext │ ← 8 rounds per 128-bit block (p⁸)
└────┬──────────────┘
│ └──► Ciphertext C
│
┌────▼─────┐
│ Ascon-p │ ← 12 rounds (finalization)
│ (p¹²) │
└────┬─────┘
│ ⊕ K
└──────────────► Authentication Tag T (128 bit)
The core of Ascon is the permutation p, applied repeatedly for a given number of rounds. Each round consists of three layers:
A round constant is XORed into word S₂ to break symmetry between rounds and prevent slide attacks.
A 5-bit S-box is applied bitsliced across all 64 columns of the 5×64 state matrix. The S-box is defined by the following Boolean equations over GF(2):
S₀' = (x₀+x₄) + ((x₁+1)·(x₁+x₂)) + (x₄+x₃) + ((x₀+x₄+1)·x₁)
S₁' = (x₀+x₄) + ((x₁+1)·(x₁+x₂)) + x₁ + ((x₁+x₂+1)·x₃)
S₂' = (x₁+x₂) + ((x₃+1)·(x₃+x₄)) + 1
S₃' = (x₁+x₂) + ((x₃+1)·(x₃+x₄)) + x₃ + ((x₃+x₄+1)·(x₀+x₄))
S₄' = (x₃+x₄) + (x₀+x₄+1)·x₁
This provides non-linearity (confusion) across the state.
Each 64-bit word is mixed with two rotated copies of itself:
S₀ ← S₀ ⊕ (S₀ ⋘ 19) ⊕ (S₀ ⋘ 28)
S₁ ← S₁ ⊕ (S₁ ⋘ 61) ⊕ (S₁ ⋘ 39)
S₂ ← S₂ ⊕ (S₂ ⋘ 1) ⊕ (S₂ ⋘ 6)
S₃ ← S₃ ⊕ (S₃ ⋘ 10) ⊕ (S₃ ⋘ 17)
S₄ ← S₄ ⊕ (S₄ ⋘ 7) ⊕ (S₄ ⋘ 41)
This provides diffusion, spreading each bit's influence across the entire word.
Inputs are provided as binary strings (sequences of "0" and "1"):
load "magma/Ascon.mag";
// 128-bit key, nonce, associated data and plaintext (as binary strings)
K := "00000000000000000000000000000000" ^ 4; // 128 zeros
N := "00000000000000000000000000000000" ^ 4; // 128 zeros
A := "01100001011000100110001100000000"; // associated data
P := "01101000011001010110110001101100"; // plaintext
// Encrypt
C, T := Ascon_AEAD128_enc(K, N, A, P);
print "Ciphertext:", C;
print "Tag: ", T;
// Decrypt
M := Ascon_AEAD128_dec(K, N, A, C, T);
print "Plaintext: ", M;
// If the tag does not verify, returns "fail"
| Property | Value |
|---|---|
| Key size | 128 bits |
| Nonce size | 128 bits |
| Tag size | 128 bits |
| State size | 320 bits |
| Security level | 128 bits |
Nonce uniqueness is critical — reusing the same (key, nonce) pair for two different plaintexts completely breaks confidentiality. Each encryption must use a fresh nonce.
Ascon was designed with three goals that make it stand out among lightweight ciphers:
- Simplicity — the entire algorithm is built from one permutation, making formal analysis and hardware implementation straightforward
- Efficiency — the bitsliced S-box and rotation-based diffusion layer are extremely fast on both hardware and software
- Provable security — the sponge construction has well-understood security proofs based on the indifferentiability framework
These properties led NIST to select it over 56 competing candidates in a multi-year evaluation process concluded in 2023.
ascon-aead128/
├── README.md
└── magma/
├── Ascon.mag # Full Ascon-AEAD128 implementation
└── test.txt # Test vectors
The file magma/test.txt verifies the implementation against 10 official KAT vectors taken from the ascon-c reference repository (NIST SP 800-232, Ascon v1.2):
| Count | PT | AD length | Source |
|---|---|---|---|
| 1 | empty | 0 bytes | KAT file Count=1 |
| 2 | empty | 1 byte | KAT file Count=2 |
| 3 | empty | 2 bytes | KAT file Count=3 |
| 4 | empty | 3 bytes | KAT file Count=4 |
| 5 | empty | 4 bytes | KAT file Count=5 |
| 34 | 1 byte | 0 bytes | KAT file Count=34 |
| 35 | 1 byte | 1 byte | KAT file Count=35 |
| 36 | 1 byte | 2 bytes | KAT file Count=36 |
| 37 | 1 byte | 3 bytes | KAT file Count=37 |
| 38 | 1 byte | 4 bytes | KAT file Count=38 |
Run the tests with:
load "magma/Ascon.mag";
load "magma/test.txt";
// Expected output:
// Count 1: correct!
// ...
// Results: 10 passed, 0 failed out of 10 tests.
- toy-block-cipher — SPN block cipher implementation (AES-like structure)
- e0-stream-cipher — E0 Bluetooth stream cipher with LFSRs
Group project — MSc Mathematics, specialization in Cryptography. University of Trento, Italy.