# Study About the Performance of Ascon in Arduino Devices
## 3 Ascon as Authenticated Encryption
### Ascon AEAD Operation  
As previously mentioned, the different steps and blocks that Ascon must process for encryption and decryption include the key, nonce, associated data, plaintext or ciphertext, and tag (see [10]). Depending on the algorithm version, the nonce is processed or stored to be used in different operations during the cipher operation. Before block processing, Ascon initializes the cipher status register with an initial value that depends on an initialization vector (\(IV\)). The value of these \(IV\) varies according to the Ascon version and can take the following values:  
\[IV_{k,r,a,b}\gets k\|r\|a\|b\|0^{160-k}= \begin{cases}80400c060000000& \text{for Ascon-128}\\ 80800c0800000000&\text{for Ascon-128a}\\ \text{a0400c06}&\text{for Ascon-80 pq}\end{cases}  \tag{7}\]  
The initialization algorithm (Algorithm 1) of Ascon consists in storing in the state register, \(S\), the concatenation of the fixed initial vector, \(IV\), the key, \(K\), and the nonce, \(N\). Then, the state register, \(S\), is updated with the XOR operation between the result of applying \(a\) times the permutation \(p\) to the previous state register and the key, \(K\), with a padding of a convenient number of zeros. ```
0: key \(K\in\{0,1\}^{k},k\leq 160\), and nonce \(N\in\{0,1\}^{128}\) \(S\gets IV_{k,r,a,b}\|K\|N\) \(S\gets p^{a}(S)\oplus(0^{320-k}\|K)\)
```
0: update \(S\) (modifies internal state) ```
**Algorithm 1** Initialization process  
The data association process consists, as shown in Algorithm 2, in dividing the data into blocks of \(r\) bits. If the last block is incomplete, a padding is applied. This padding involves adding a 1 immediately after the last bit of the block, followed by 0s until the block reaches a length of \(r\) bits. Later, each block is introduced in the state register by means of an XOR operation between the associated data \(A_{i}\) and the internal part of the state, \(S_{r}\). Then, the permutation \(p\) is executed \(b\) times. The above steps are repeated for each of the blocks \(A_{i}\). Finally, the XOR operation of the state \(S\) with a string of 0s and 1s in the LSB is stored in the state register. The encryption algorithm, \(\mathcal{E}_{k,r,a,b}\) is shown in Figure 3. The procedure for encryption plaintext processing follows a similar procedure to that of the associated data, with the difference being that the output of the plaintext processing corresponds to the ciphertext. In fact, in this process (see Algorithm 3), the plaintext is divided into \(r\)-bit blocks and if the last block is incomplete, it is padded with zeros. Then, the state register collects the blocks resulting from the XOR operation between the plaintext \(P_{i}\) and the internal part of the state register \(S_{r}\), which corresponds to a block of the ciphertext \(C_{i}\). Once the block is incorporated into the state register, the permutation \(p\) is executed, \(b\) times. These three steps are repeated for each block of the plaintext, except for the last \(r\)-bit block. Finally, the XOR operation between the last plaintext block \(P_{t}\) and the inner part of the state \(S_{r}\), is entered into the state register. The last block of the ciphertext will be the MSB of the \(S_{r}\) state resulting from the last XOR operation. In this case the permutation is not applied again. ```
0: plaintext \(P\in\{0,1\}^{*}\) and internal state \(S\) \(P_{1}\ldots P_{t}\leftarrow\) divide \(P\) into \(r\)-bits blocks by concatenating \(P\|1\|0^{*}\) (padded to make the last block exactly \(r\)-bits long) for\(i=1\ldots s\)do \(S\gets p^{b}((S_{r}\oplus A_{i})\|S_{c})\) endfor endif \(S\gets S\oplus(0^{319}\|1)\) Output: update \(S\) (modifies internal state)
```
**Algorithm 2** Processing associated data  
On the other hand, the decryption algorithm, \(\mathcal{D}_{k,r,a,b}\), is illustrated in Figure 4. The decryption (ciphertext processing) is very similar to the encryption. They differ in the order in which the operations are applied, as shown in Algorithm 4.