Constructions

Ascon MAC and PRF: Securing the IoT with Lightweight Cryptography

Speakers: [Speaker's name not provided in input], Christoph Dobraunig, Maria Eichlseder, Martin Schläffer

Conference: RSAC 2024

YouTube: https://www.youtube.com/watch?v=Ln0DobG0Kl4

Overview

This talk delves into the Ascon cryptographic primitive, specifically focusing on its recently developed Message Authentication Code (MAC) and Pseudo-Random Function (PRF) constructions. Ascon is a lightweight cryptographic algorithm that was selected by the U.S. National Institute of Standards and Technology (NIST) for standardization, addressing the critical need for robust yet efficient security solutions in the burgeoning Internet of Things (IoT) landscape. Presented by one of the co-authors of the work, this session highlights how Ascon's permutation-based design, originally conceived for authenticated encryption and hashing, has been extended to provide highly efficient MAC and PRF capabilities.

The significance of Ascon, and these new constructions, cannot be overstated in an era where billions of low-power, constrained devices connect to networks worldwide. Traditional cryptographic standards like AES-GCM and SHA-3, while secure, are often too computationally intensive and energy-demanding for these resource-limited environments. Ascon offers a compelling alternative, providing a comparable security level to AES-128 and SHA-256 but with significantly improved performance and inherent resistance to side-channel attacks, making strong security feasible where it was previously cost-prohibitive. This talk illuminates the technical underpinnings, security proofs, and practical advantages of Ascon's MAC and PRF, positioning them as essential tools for securing future IoT ecosystems.

Background

▶ Watch: Introduction to Ascon and IoT security challenges (0:00)

The rapid expansion of the Internet of Things (IoT) is fundamentally transforming various industries and aspects of daily life, with an estimated 50 billion devices currently connected and this number projected to double by 2030. While this connectivity offers unprecedented opportunities, it simultaneously introduces profound security challenges. Each connected device, particularly low-end sensors with limited computational power and strict energy consumption requirements (often battery-powered), represents a potential attack vector. Protecting the vast amounts of data transmitted and generated by these devices is paramount, yet implementing strong security on such constrained hardware is notoriously difficult.

Current cryptographic standards, such as AES-GCM for authenticated encryption and SHA-3 for hashing, were primarily designed for high-end servers and general-purpose computing environments. Their resource demands—in terms of processing power, memory footprint, and energy consumption—make them unsuitable for the vast majority of IoT devices. Recognizing this critical gap, NIST launched a public competition for lightweight cryptography over five years to identify new cryptographic schemes optimized for these constrained environments. This competition, mirroring past successful initiatives like the AES and SHA-3 competitions, aimed to standardize algorithms offering both confidentiality and authenticity (authenticated encryption) as well as hashing, that are more efficient than existing standards.

Ascon emerged as a prominent winner in the NIST Lightweight Cryptography competition, selected for standardization in early 2023. While lightweight cryptography has sometimes been perceived as offering less security than established algorithms like AES and SHA-2, the candidates submitted to NIST, including Ascon, provide security margins comparable to AES-128 and SHA-256. This means Ascon can serve as a direct, drop-in replacement for existing standardized algorithms in appropriate contexts. The primary motivation for adopting Ascon in IoT applications is its exceptional efficiency on low-end devices. Public benchmarking during the NIST competition demonstrated that Ascon achieves three to five times higher speeds than AES-GCM in software implementations on microcontrollers, and delivers twice the throughput with half the energy consumption in hardware implementations. Furthermore, Ascon is designed for efficient protection against side-channel attacks, a significant advantage over AES, where such protections can be more challenging and costly to implement. In essence, Ascon enables robust data security in IoT scenarios where it was previously deemed too expensive or impractical.

Ascon's journey began even before the NIST competition. It was initially designed over a decade ago as a response to the CAESAR competition, an academic initiative to find new authenticated encryption algorithms superior to AES-GCM. Ascon was recognized as a winner in the lightweight application category of CAESAR. The recent additions of dedicated MAC and PRF constructions, presented in this talk, further broaden Ascon's utility and solidify its position as a versatile, efficient, and secure cryptographic cornerstone for the IoT.

Key Findings

▶ Watch: Why choose Ascon? Key advantages and efficiency (2:00)

The talk highlights several crucial findings regarding Ascon's capabilities and its new MAC and PRF constructions:

Firstly, Ascon's official selection by NIST for standardization marks a significant milestone. This endorsement validates its security and efficiency for lightweight applications, providing a trusted foundation for widespread adoption in IoT devices.

Secondly, the development and formal security proofs for dedicated Message Authentication Code (MAC) and Pseudo-Random Function (PRF) constructions based on Ascon’s core permutation are key contributions. While authenticated encryption schemes (like Ascon AEAD) provide both confidentiality and integrity, and hash functions can be used in MAC-like modes, the new Ascon MAC and PRF are specifically optimized for efficiency in pure authentication or key derivation scenarios. This addresses a critical need identified by the cryptographic community and industry for efficient, standalone authentication primitives.

A major finding is Ascon's superior efficiency on constrained devices. Benchmarking from the NIST competition demonstrated that Ascon achieves 3 to 5 times higher speeds in software implementations on low-end microcontrollers compared to AES-GCM. In hardware, it delivers twice the throughput with half the energy consumption. For the new MAC construction, this translates to being approximately four times more efficient than using a hash function in a KMAC-like mode, primarily because it can absorb 256 bits per iteration compared to 64 bits for the hash.

Furthermore, Ascon offers comparable security margins to established standards like AES-128 and SHA-256. Despite its lightweight nature, extensive cryptanalysis over the past decade has shown robust security against known attack techniques. The best-known attacks for key recovery on Ascon AEAD affect up to 7 out of 12 rounds, leaving a comfortable 5-round security margin. For forgery attacks, the best-known differential cryptanalysis targets 3 out of 12 rounds. These margins extend directly to the MAC construction, providing high confidence in its integrity.

Finally, Ascon's design inherently supports efficient side-channel protection. Its simple structure and low algebraic degree of its S-box make it easier and less costly to implement countermeasures against attacks that exploit physical leakage, such as power consumption analysis or electromagnetic emanations. This is a significant advantage in real-world IoT deployments where adversaries often have physical access to devices.

Technical Deep Dive

▶ Watch: Ascon's origins: CAESAR competition and new additions (3:38)

Ascon's design is rooted in the sponge construction, a permutation-based approach that allows a single core permutation to derive multiple cryptographic primitives. The heart of Ascon is a 320-bit permutation, structured as a state of five 64-bit registers. This permutation is applied iteratively through a sequence of rounds, combining non-linear and linear operations to ensure strong cryptographic properties.

The non-linear component of Ascon's permutation is an S-box applied to the columns of the state. This S-box is an affine equivalent to the Keccak S-box (used in SHA-3), but crucially, it is designed for efficient implementation in both software and hardware, requiring only a few additional XOR operations. A key characteristic of this S-box is its algebraic degree of two, meaning it involves only a few AND gates. This low degree is particularly advantageous for implementing side-channel attack countermeasures efficiently, as it simplifies the masking and blinding techniques used to protect against power analysis.

The linear operations are inspired by the sigma functions found in SHA-2, involving a few XORs and rotations applied to each of the 64-bit registers. This combination of a simple, low-degree S-box with robust linear diffusion operations results in a permutation with excellent cryptographic properties, including strong resistance against linear and differential cryptanalysis. Research by colleagues from Radboud University, for instance, demonstrated that the best differential and linear attacks on the Ascon permutation already have probabilities below 2^-129 for six rounds, providing a significant security margin when 12 rounds are used.

Ascon Authenticated Encryption (AEAD)

The Ascon AEAD scheme, originally designed for the CAESAR competition, exemplifies the flexibility of the sponge construction. It takes a key, a nonce, optional associated data (AD), and plaintext as input, producing ciphertext and an authentication tag. The process involves:

1. Initialization: The key, nonce, and a predefined initial value are loaded into the 320-bit state. The permutation is then applied 12 times. The key is XORed into the state again.
2. Associated Data Processing: The associated data is processed by XORing it into specific parts of the state, followed by 6 rounds of the permutation. This process continues until all AD is absorbed.
3. Encryption: Plaintext blocks are XORed into the state, and the resulting ciphertext is extracted. After each block, 6 rounds of the permutation are applied.
4. Finalization: The key is XORed into the state, followed by 12 rounds of the permutation. The key is XORed again, and a 128-bit tag is extracted from the state.

Decryption is highly similar to encryption, primarily involving swapping the roles of plaintext and ciphertext, which allows for minimal implementation overhead. Ascon offers two versions: the standard version with 12 and 6 rounds (as described above) and a slightly more performant "A" version with different round counts and block sizes. The standard version provides higher robustness, achieving 128-bit security even if the internal state is compromised by strong side-channel attacks, whereas the "A" version offers 96-bit security in such scenarios, still considered sufficient for practical attacks.

Ascon MAC and PRF Constructions

Building upon the robust Ascon permutation, the new MAC and PRF constructions leverage its keyed nature to enhance efficiency compared to generic hash-based constructions like KMAC. These constructions are very similar to the hash function mode but are designed to be explicitly keyed.

The primary difference and advantage lie in the absorbing and squeezing rates. For the Ascon hash function, security requirements limit the absorbing rate to 64 bits per iteration. However, with a key involved, the MAC and PRF can securely absorb 256 bits per iteration. Similarly, for tag generation (squeezing), they can produce chunks of 128 bits. This significantly higher rate makes the Ascon MAC approximately four times more efficient than using the Ascon hash function in a KMAC-like mode, particularly for long messages.

For applications requiring authentication of very short messages, such as low-cost mutual authentication in challenge-response protocols or pointer authentication, a short PRF construction is also defined. This short PRF is based on the initialization phase of the Ascon AEAD. It takes an input (analogous to the nonce) of at most 128 bits and produces a 128-bit output tag. This design is extremely efficient for short inputs, making it ideal for resource-constrained scenarios where minimal overhead is crucial.

Security and Cryptanalysis

Formal security proofs exist for both the PRF, MAC, and short PRF, demonstrating their security under the assumption of an ideal permutation. Bart Mennink's 2022 security proof specifically validates these constructions. The security relies heavily on the extensive cryptanalysis conducted on the Ascon AEAD scheme and its core permutation since its inception, including work presented at TRC in 2015.

The best-known attacks on Ascon AEAD, which translate to the MAC and PRF, provide substantial security margins:

• Key Recovery: Best attacks are effective up to 7 out of 12 rounds of the permutation, leaving a 5-round security margin. The complexity of these attacks is very close to a brute-force attack.
• Forgery Attacks: Based on differential cryptanalysis, the best-known attack targets 3 out of 12 rounds.
• Permutation Attacks: Detailed analysis of the Ascon permutation itself, including work from Radboud University, shows that differential and linear attacks achieve probabilities below 2^-129 for just 6 rounds. This implies that cryptanalysts can at most attack five rounds of the scheme using these techniques, while 12 rounds are used in the MAC construction, providing immense confidence.
• Algebraic Attacks: While the low algebraic degree of the S-box could potentially be exploited by algebraic attacks, the overall structure of Ascon has been shown to make attacks beyond 7 rounds very difficult.

In summary, Ascon, including its new MAC and PRF constructions, offers a 128-bit security level comparable to AES-128 and SHA-256, backed by over a decade of thorough cryptographic analysis and formal proofs, with significant margins against all known attack vectors.

Demo / Proof of Concept

▶ Watch: Key cryptographic properties of Ascon's permutation (5:20)

The talk focused on the theoretical and design aspects, as well as the security and performance benefits of the Ascon MAC and PRF constructions. It did not feature a live demonstration or a specific proof-of-concept implementation during the presentation. The speaker referenced the availability of open-source hardware implementations by the academic community for benchmarking and indicated that public implementations for side-channel protection are also available.

Defensive Implications

▶ Watch: Building an authenticated encryption scheme with Ascon (6:00)

The introduction and standardization of Ascon's MAC and PRF constructions have significant implications for cybersecurity defenders, particularly those operating in the IoT domain.

1. Prioritize Ascon for IoT Security: Defenders should actively consider adopting Ascon for new IoT deployments and potentially for retrofitting existing systems where performance and resource constraints are critical. Its selection by NIST provides a stamp of approval, making it a reliable choice for securing data in environments where traditional standards are impractical.
2. Leverage Enhanced Efficiency: For devices with extremely limited computational power and energy budgets, Ascon offers a pathway to implement strong cryptographic security that was previously too costly. Its 3-5x software speed advantage over AES-GCM and 2x throughput with half the energy in hardware can enable security features on devices that could not support them before, reducing the attack surface across the IoT ecosystem.
3. Utilize Dedicated MAC/PRF for Integrity and Authentication: The new Ascon MAC and PRF constructions provide highly efficient mechanisms specifically for data integrity, message authentication, and key derivation. Defenders should integrate these into protocols requiring authentication of messages, secure key exchange, or efficient challenge-response mechanisms, especially for short messages where the short PRF excels. This allows for robust authentication without the overhead of full authenticated encryption when confidentiality is not required.
4. Benefit from Side-Channel Resistance: Ascon's design facilitates efficient protection against side-channel attacks, which are a major concern in IoT devices often deployed in physically accessible locations. Defenders can implement Ascon with greater confidence in its resistance to power analysis and other physical attacks, reducing the risk of key exfiltration.
5. Standardize and Consolidate: Ascon's permutation-based design allows a single core primitive to serve multiple cryptographic needs (AEAD, hash, MAC, PRF). This flexibility can simplify implementation, reduce code size, and streamline security audits for constrained devices, as defenders can rely on one well-analyzed algorithm for most cryptographic functions.
6. Stay Informed on NIST Standardization: While Ascon has been selected, the final NIST standard is still being drafted. Defenders should monitor NIST publications for the final specification and any associated implementation guidelines to ensure compliance and best practices in their deployments.

By embracing Ascon and its new MAC/PRF capabilities, defenders can significantly enhance the security posture of their IoT devices, making strong, efficient, and side-channel resistant cryptography a practical reality for the billions of connected devices forming our increasingly interconnected world.

Key Takeaways

• Ascon is a NIST-selected lightweight cryptographic standard, providing comparable security to AES-128 and SHA-256 but optimized for resource-constrained IoT devices.
• Exceptional Efficiency: Ascon offers significantly higher performance on low-end microcontrollers (3-5x faster than AES-GCM in software) and hardware (2x throughput with half the energy).
• New MAC and PRF Constructions: Dedicated Message Authentication Code (MAC) and Pseudo-Random Function (PRF) constructions based on Ascon's core permutation are introduced, offering highly efficient authentication, integrity, and key derivation, being approximately four times more efficient than hash-based alternatives for long messages.
• Robust Security Margins: Extensive cryptanalysis over a decade has demonstrated Ascon's strong resistance to known attacks, with comfortable security margins (e.g., 5 rounds for key recovery out of 12 rounds used).
• Inherent Side-Channel Resistance: Ascon's design, particularly its low-degree S-box, enables highly efficient protection against side-channel attacks, crucial for physically accessible IoT devices.
• Flexible and Unified Design: Ascon's permutation-based approach allows a single, well-analyzed primitive to serve multiple cryptographic functions (authenticated encryption, hashing, MAC, PRF), simplifying implementation and reducing footprint on constrained devices.

About the Speaker(s)

The presentation on Ascon's MAC and PRF constructions was delivered by one of the key contributors to the project. The work is a joint effort with Christoph Dobraunig, Maria Eichlseder, and Martin Schläffer. The speaker represents this team of researchers who have been instrumental in the design, analysis, and standardization of Ascon, a leading lightweight cryptographic primitive. Their collective expertise in symmetric cryptography, cryptanalysis, and efficient implementation has been pivotal in Ascon's success in the NIST Lightweight Cryptography competition and its ongoing development.