# Study About the Performance of Ascon in Arduino Devices
## 4 Security Analysis
### Side-Channel Attacks  
It is well known that any processor computing a cryptographic primitive is prone to information leaks. Side-channel attacks attempt to obtain information from the implementations performed on cryptographic devices. These attacks are responsible for exploiting such leaks and recovering secret information. They can be divided in time, electromagnetic fields, and power consumption attacks, which are the most common ones regarding Ascon. Although Ascon is based on the MonkeyDuplex sponge, it has powerful initialization and termination phases. This means that trying to recover the state during an intermediate process between these two phases, or after termination, would not imply being able to recover the keys, in fact it would be a very complicated task. Therefore, power consumption attacks executed during the data processing phases only allow recovering the internal state. On the other hand, attacks performed during the finalization phase are hardly successful, since they have to consider not only many bits of the key, but also several unknown bits of the state that is not related with the final tag. Taking these factors into account, it is easy to deduce that the initialization phase is the easiest phase to find a successful attack to recover the key. Power analysis attacks consist of the study and exploitation of information leakage by measuring the power consumption of a cryptographic function implemented in a device. There are two types of power attacks: simple power analysis (SPA) and differential power analysis (DPA). In SPA, the attacker needs only a minimum number of power traces to look for patterns that can be related to actions in the cryptographic operation using the key. On the other hand, in DPA, a deeper knowledge of the device and algorithm to be attacked is required, as well as a greater number of traces than in SPA, to model possible situations with certain inputs and power consumption and thus be able to recover the key or parts of it. In [27], the resistance of Ascon to passive and active side-channel attacks is evaluated. To perform the experiments, the authors use a lightweight implementation on an Artix-7 FPGA (field programmable gate array). In the paper, two attacks are exposed, the first of which is a statistical ineffective fault analysis (SIFA) attack using voltage glitches on the supply pin of the FPGA chip. In this attack, \(2^{80}\) correct tags are used as output of the algorithm under fault injection of the S-boxes and thus manage to recover two bits of the secret key. But the main attack of the paper and where the complete key is recovered is the power analysis attack with deep learning (DL) in the initialization phase. This attack is a side-channel attack with reinforcement learning (SCARL). One of the strengths of the attack is that the attacker does not need to have prior knowledge of the leakage model of the cryptographic operation. First, the long short-term memory (LSTM) autoencoder collects a large number of raw power measurements, recognizes the best way to model the data, and generates an intermediate representation of the data. In the next step, using the autoencoder, a representation of an estimated leakage model is created. Finally, using the previously estimated model and a clustering technique, the secret key can be recovered (also see [28]). In [29] (this work has been also published as [30]), the authors studied the Ascon encryption by considering fault injection attacks, especially under the prism of differential fault analysis (DFA). By using this technique, they recover the complete key. This is performed in two different ways with two fault models. In the first one, by leveraging bit-flip faults, and in the second one by bit-set faults. Moreover, they analyze injecting multiple bit-flip faults at the input of the S-box, which suggests an alternative strategy for compromising the state space. The main differential power attack against Ascon can be first found in [31] and in more detail in [32].