The Ascon cipher has been selected as the first choice in lightweight case and ACORN as the second. However according to Face-off between the CAESAR Lightweight Finalists: ACORN vs. Ascon paper, the winner of the face-off is ACORN.

They mentioned that

  1. ACORN-1 and Ascon-small have 18% and 74%, respectively, the area of AES-GCM.

  2. ACORN- 32 and Ascon-large are 23.3 and 2.5 times faster (respectively) than AES-GCM.

  3. ACORN-1, is the most efficient side-channel resistant CAESAR lightweight finalist, in terms of low area, power, and external randomness

Question: What are the strengths of Ascon over ACORN?


Ascon and ACORN both have interesting features. Let's discuss their pros and cons for some properties stated during the CAESAR competition for lightweight AEADs:

  1. Fits into small hardware area and/or small code for 8-bit CPUs

On this point, ACORN is more efficient as its internal state is smaller than the one used by Ascon (293 vs 320 bits). Moreover, thanks to its very compact core function, the code size of ACORN is smaller.

  1. Natural ability to protect against side-channel attacks

Regarding countermeasures against side-channel attacks, both algorithms are efficient. Ascon has been designed with bitslicing in mind, and thus can be easily implemented in a constant time manner. ACORN is also constant time by design as it does not rely on any conditional branch nor look-up tables. Regarding countermeasures against power/electromagnetic side-channels, 1st order threshold implementation can be reached using only three shares for both algorithms. However ACORN seems more efficient in hardware as stated in the paper you mentioned.

  1. Message sizes: usually short (can be under 16 bytes), sometimes longer

This is maybe the main advantage of Ascon over ACORN: it is way more efficient for short messages. This mainly comes from the fact that ACORN is a stream cipher that requires a huge number of steps to initialize its internal state. For instance, this paper reports (page 11) that Ascon outperforms ACORN for small messages (less than 128 bytes with 16 bytes of additional data) on ARM Cortex-M3. Ascon is also very efficient on 64-bit CPUs as by definition, its internal state consists of five 64-bit words. It is an interesting feature for use cases where high end servers have to handle numerous encrypted requests.

Finally, Ascon is based upon the duplex sponge mode whose security has been analyzed in several papers (e.g., https://keccak.team/files/SpongeDuplex.pdf and https://eprint.iacr.org/2015/541.pdf) while ACORN is based upon a new stream cipher construction. This probably influenced the final decision.

| improve this answer | |
  • $\begingroup$ could you please explain more how the ascon cipher is good for star topology networks? $\endgroup$ – hardyrama Apr 3 '19 at 9:24
  • 1
    $\begingroup$ @hardyrama what I wanted to highlight is that being very competitive on high end platforms like Ascon does is an advantage for use cases where servers have to deal with many encrypted requests. Star topology networks are just a specific case and I modified my answer in a more general sense. $\endgroup$ – Raoul722 Apr 4 '19 at 9:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.