# Study About the Performance of Ascon in Arduino Devices
## 4 Security Analysis
### Security Bound for Ascon
Moreover, for an unprotected implementation of Ascon, they identified the key with less than 100 traces. In [48] (and previously in [48]), the authors extend the pre-image attack framework initially developed in [49] and later improved in [50] against Keccak. The extension proposed by [PERSON] et al. [48]. is performed against the hash functionality of Ascon, in fact, against the three-round and four-round Ascon-XOF. The extension is considered in two aspects: The first is a linearize-and-guess approach, which is obtained by studying the algebraic properties of the permutation of Ascon. Then, the authors obtain that the complexity of finding a pre-image for two rounds of Ascon-XOF can be reduced to \(2^{27.56}\) guesses from \(2^{39}\) guesses, with a 64-bit hash value. In the second aspect, the authors developed an automatic pre-image attack framework based on satisfiability problems using the linearize-and-guess approach. This approach is efficient in finding the optimal structures in an exhaustive way. Another pre-image attack against two rounds of Ascon-XOF-64 was presented in [51]. This attack has a complexity of \(2^{32}\) by means of a guessing strategy. To do this, authorsconsidered a MILP model and then they extend their attack to three rounds with a time complexity of \(2^{53}\) when the \(IV\) is 0 and of \(2^{51}\) for the real \(IV\). In addition, [PERSON] et al. [51], study the behavior of Ascon-HASH against collision attacks. In this case, they consider a linearization of the inverse of S-boxes and propose a collision attack on three rounds against this functionality of Ascon. Moreover, by using this linearization and some two-round connectors, the authors extend this collision attack to 4 and 5 rounds of Ascon-HASH with complexities of \(2^{21}\) and \(2^{41}\), respectively. In [52] (and later in [52]), the authors also present more attacks against Ascon-XOF; in particular, they attack the two-round Ascon-XOF in a more efficient way than in [10]. In fact, they consider weakened versions of Ascon-XOF for which all the IV values are set to 0 and the round constants are not considered. These attacks do not suppose a real vulnerability in relation to the security of the full Ascon-XOF. A systematic study about the security of the different modes of Ascon as authenticated encryption was presented in [53]. In this work, [PERSON] and [PERSON] consider six security models in multi-user setting: (1) nonce-respecting [41], (2) nonce-misuse resistance [54], (3) nonce-misuse resilience [55], (4) leakage resilience [55], (5) state-recovery [26], and (6) release of unverified plaintext analysis [56]. Thus, it can be stated that none of the mentioned attacks violate the security requirements established by NIST; therefore, the Ascon family presents a high degree of security. NIST list the security properties of Ascon in (Section 4.4 in [3]) and they include single-key and multi-key settings, nonce-respecting and nonce-misuse settings, and with or without the truncation option. For example, in the single-key setting, the attacker tries to recover a specific key that is shared by one or several users; whereas in the multi-key setting with \(n\) keys, the attacker aims to obtain any of such keys used by the users.