# Study About the Performance of Ascon in Arduino Devices
## 4 Security Analysis
### Algebraic Attacks
#### 4.1.2 Cube Attacks  
The cube attack is a cryptanalytic technique applied to a variety of symmetric key cryptographic algorithms. The goal of this type of attack is to obtain a set of linear relations between secret bits, so that upon solving these, relations are revealed. These relations between secret bits are obtained by modifying the output bits for all possible inputs. An algorithm is vulnerable to these attacks if, after inputting a key and the associated data, an output bit can be represented as a low-degree polynomial over the finite field of two elements, \(\mathbb{F}_{2}\).  
Within the range of attacks on the algebraic features of Ascon, conditional cube attacks can be distinguished. In particular, in [25], an attack that recovers the complete state and secret key of Ascon-128a, using seven of the eight rounds of the Ascon permutation in the intermediate phase, is presented. This is the best known attack for this version of the algorithm. [PERSON] et al. also presented a complete state and secret key-recovery attacks for the post-quantum security version Ascon-80 pq and Ascon-128 using all six rounds of the permutation in the intermediate phase, i.e., the full number of rounds of the original design [25].  
The success of this type of attack relies on the misuse of the nonce \(N\), although Ascon designers claim that the AEAD versions provide a security level of 128 bits and 160 bits in the case of Ascon-80 pq when different nonces are used for the same key \(K\). According to the designers, this level of security also holds in a nonce-misuse scenario, as long as the repetition of the nonce is only a few times and the combination of the nonce \(N\) and the associated data \(A\) remains unique. This type of attack succeeds by exhaustively repeating the same nonce and eliminating or repeating the associated data, as well as violating other features that make the algorithm secure.  
For the attack to succeed, it must be assumed that the associated datum \(A\) is empty. Moreover, it should be known that \(S_{0}=S_{0}[0]\|S_{0}[1]\|S_{0}[2]\|S_{0}[3]\|S_{0}[4]\) is the input state to the Ascon permutation for the first block of plaintext in the encryption phase. Due to the rate \(r=64\), the values of \(S_{0}[0]\) can be known by choosing the first block of plaintext and thus obtaining the corresponding ciphertext block, while \(S_{0}[1]\|S_{0}[2]\|S_{0}[3]\|S_{0}[4]\) will remain secret and only depends on the nonce \(N\) to change. By means of a family of patterns in which a series of variables and conditions to be fulfilled are defined, along with the requirements of the conditional cube attack and subsequent operations, the entire state \(S_{0}\) is recovered, i.e., \(S_{0}[0]\|S_{0}[1]\|S_{0}[2]\|S_{0}[3]\|S_{0}[4]\) for the six intermediate rounds of the Ascon-80 pq permutation. With the recovered \(S_{0}\) state and the previously used nonce, the 160-bit key is recovered. This attack and others shown in [25] currently represent the most effective methods in an Ascon nonce-misuse scenario. In any case, these attacks do not compromise the original Ascon security, as the attack would only succeed in a scenario where the algorithm is not implemented with the constraints and instructions that the designers presented in [10].  
Moreover, in [26], the authors describe a security model of authenticity under the hypothesis of state recovery. Their analysis considers that the mode aims to guarantee security and authenticity against the key recovery attack even if an adversary can recover the inner state by a leakage, for example. In conclusion, [PERSON] and [PERSON] proved that thanks to its unique key blinding technique, Ascon satisfies this security property.