A New Conditional Cube Attack on Reduced-Round Ascon-128a in a Nonce-misuse Setting

Ascon is one of the finalists of the National Institute of Standards and Technology (NIST) lightweight cryptography standardization process. In 2019, Ascon was also selected as the primary choice for lightweight authenticated encryption in the final portfolio of the CAESAR competition. The Ascon... See full abstract

Ascon is one of the finalists of the National Institute of Standards and Technology (NIST) lightweight cryptography standardization process. In 2019, Ascon was also selected as the primary choice for lightweight authenticated encryption in the final portfolio of the CAESAR competition. The Ascon family includes three variants; Ascon-128 (primary), Ascon-128a, and Ascon-80pq. In this paper, we study the security of Ascon-128a in a nonce-misuse setting, and present new state and key recovery attacks on a reduced-round Ascon-128a in which the internal permutation for associated data and message processing is reduced from 8 to 7 rounds (the number of rounds for initialization and finalization remain unchanged). Our state-recovery attack requires 2¹¹⁷ data and 2¹¹⁸ time with negligible memory. After recovering the state, again in a nonce-misuse scenario, secret key can be recovered with additional 2³² data, 2^97.6 time and 2³² memory complexities. The presented attacks do not violate the security claims of the designers.
Hide full abstract