Paper 2026/1082

Compact Yet Fast: An Efficient d-Order Masked Implementation of Ascon

Abstract

In this work, we present a generic side-channel protected design of Ascon that achieves high efficiency by dynamically reconfiguring the hardware countermeasures during message processing. The resultant implementation is protected and capable of meeting stringent performance requirements whilst minimising resource overhead. The experimental results obtained demonstrate that the implementation meets the required security and achieves superior throughput-to-area ratio across all protection orders. Ascon, recently selected by NIST as the lightweight cryptography standard, is widely deployed in resource-constrained devices that demand both high performance and resistance against threats such as side-channel analysis (SCA). Exploiting Ascon's mode-level structure, which does not require protection against differential power analysis during bulk operations, we introduce a modified masking gadget with dual functionality: serving as a countermeasure during critical operations, and processing multiple data paths in parallel to accelerate bulk computation. Our architecture supports any configurable security order and instantiates only the minimum hardware resources needed to maximize throughput per round. We also evaluate an enhanced Ascon architecture based on the Changing of the Guards technique, which eliminates the need for fresh randomness. Security validation is performed using fixed-vs-random t-tests on both first- and second-order masked implementations. Finally, we compare our masked design against state-of-the-art solutions.

Note: - A good addition to the state of the art comparison would have been the work in [1]. As in our work, the authors exploit the leveled implementation of ASCON to enable runtime hardware reconfiguration. However, their methodology primarily aims latency and energy efficiency utilizing techniques such as hardware duplication and clock gating. - It must be noted that, from a side-channel security perspective, the composability of the Domain-Oriented Masking (DOM) implementation is not guaranteed at higher security orders. [1] Cassiers, G., Standaert, F.X. and Verhamme, C., 2024. Low-Latency Masked Gadgets Robust against Physical Defaults with Application to Ascon. IACR Transactions on Cryptographic Hardware and Embedded Systems, 2024(3), pp.603-633.