Paper 2022/1377

Improved Differential and Linear Trail Bounds for ASCON

Solane El Hirch, Radboud University
Silvia Mella, Radboud University
Alireza Mehrdad, Radboud University
Joan Daemen, Radboud University

ASCON is a family of cryptographic primitives for authenticated encryption and hashing introduced in 2015. It is selected as one of the ten finalists in the NIST Lightweight Cryptography competition. Since its introduction, ASCON has been extensively cryptanalyzed, and the results of these analyses can indicate the good resistance of this family of cryptographic primitives against known attacks, like differential and linear cryptanalysis. Proving upper bounds for the differential probability of differential trails and for the squared correlation of linear trails is a standard requirement to evaluate the security of cryptographic primitives. It can be done analytically for some primitives like AES. For other primitives, computer assistance is required to prove strong upper bounds for differential and linear trails. Computer-aided tools can be classified into two categories: tools based on general-purpose solvers and dedicated tools. General-purpose solvers such as SAT and MILP are widely used to prove these bounds, however they seem to have lower capabilities and thus yield less powerful bounds compared to dedicated tools. In this work, we present a dedicated tool for trail search in ASCON. We arrange 2-round trails in a tree and traverse this tree in an efficient way using a number of new techniques we introduce. Then we extend these trails to more rounds, where we also use the tree traversal technique to do it efficiently. This allows us to scan much larger spaces of trails faster than the previous methods using general-purpose solvers. As a result, we prove tight bounds for 3-rounds linear trails, and for both differential and linear trails, we improve the existing upper bounds for other number of rounds. In particular, for the first time, we prove bounds beyond $2^{-128}$ for 6 rounds and beyond $2^{-256}$ for 12 rounds of both differential and linear trails.

Available format(s)
Attacks and cryptanalysis
Publication info
Differential Trail Search Linear Trail Search Trail Weight Bounds ASCON
Contact author(s)
solane elhirch @ ru nl
silvia mella @ ru nl
alireza mehrdad @ ru nl
joan @ cs ru nl
2022-10-20: revised
2022-10-12: received
See all versions
Short URL
Creative Commons Attribution


      author = {Solane El Hirch and Silvia Mella and Alireza Mehrdad and Joan Daemen},
      title = {Improved Differential and Linear Trail Bounds for ASCON},
      howpublished = {Cryptology ePrint Archive, Paper 2022/1377},
      year = {2022},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.