# Study About the Performance of Ascon in Arduino Devices
## 3 Ascon as Authenticated Encryption
### Ascon AEAD Operation
In this case, the ciphertext is also divided into \(r\)-bit blocks. As in the previous case, if the last block is incomplete, a pad is added to reach \(r\)-bits. Later, the decryption operation invoperation between the encrypted block, \(C_{i}\), and the internal part of the state, \(S_{r}\). The result will be the plaintext \(P\). The value of the state register during the encryption process is recovered by entering the ciphertext \(C\) in the internal part of the state register \(S_{r}\). Then, the permutation \(p\) is executed \(b\) times. The previous three steps are repeated with all the \(C_{i}\) blocks, except for the last one. Using the XOR operation between the last ciphertext block \(\tilde{C}_{t}\) and the internal part of the state register \(S_{r}\), the last plaintext block, \(P_{t}\), is calculated. Finally, in the internal part of the state register \(S_{r}\), the result of the XOR operation between this part of the state, and the last block of the plain text \(P_{t}\) (with its corresponding pad if necessary) is entered. This last status update is necessary to complete the finalization process in which the tag to be generated is verified or not. Two distinct use cases can be identified in the finalization process. If the purpose of the algorithm execution is to encrypt a message, the finalization process generates and transmits a MAC or a tag, \(T\), which depends on the entire previous process (see Algorithm 5). If the purpose of the process is to verify the decryption, the finalization process will compare the tag generated by the decryption process with the tag that was previously generated in the encryption process (see Algorithm 6). For both cases, in the computation of the tag, the state \(S\) is updated by executing \(a\) times the permutation \(p\) to the result of the XOR operation between the state register, a concatenation of \(r\) zeros, the key \(K\), and the remaining zeros required to complete the 320 bits of the state. Finally, the tag \(T\) is generated through the XOR operation between the \(r\) LSB of the \(S\) state and the \(r\) LSB of the \(K\) key. ```
0: key \(K\in\{0,1\}^{k},k\leq 160\), and internal state \(S\) \(S\gets p^{a}(S\oplus(0^{r}\|K\|0^{c-k}))\) \(T\leftarrow\lceil S\rceil^{128}\oplus\lceil K\rceil^{128}\) Output: tag \(T\in\{0,1\}^{128}\)
```
**Algorithm 5** Finalization process (encryption)  
Two distinct use cases can be identified in the finalization process. If the purpose of the algorithm execution is to encrypt a message, the finalization process generates and transmits a MAC or a tag, \(T\), which depends on the entire previous process (see Algorithm 5). If the purpose of the process is to verify the decryption, the finalization process will compare the tag generated by the decryption process with the tag that was previously generated in the encryption process (see Algorithm 6). For both cases, in the computation of the tag, the state \(S\) is updated by executing \(a\) times the permutation \(p\) to the result of the XOR operation between the state register, a concatenation of \(r\) zeros, the key \(K\), and the remaining zeros required to complete the 320 bits of the state. Finally, the tag \(T\) is generated through the XOR operation between the \(r\) LSB of the \(S\) state and the \(r\) LSB of the \(K\) key. ```
0: key \(K\in\{0,1\}^{k},k\leq 160\), and internal state \(S\) \(S\gets p^{a}(S\oplus(0^{r}\|K\|0^{c-k}))\) \(T\leftarrow\lceil S\rceil^{128}\oplus\lceil K\rceil^{128}\) Output: tag \(T\in\{0,1\}^{128}\)
```
**Algorithm 6** Finalization process (encryption)  
Figure 4: The decryption algorithm \(\mathcal{D}_{k,r,a,b}\)[10] (* means that the plaintext can be of variable length). ```
0: key \(K\in\{0,1\}^{k},k\leq 160\), and internal state \(S\) \(S\gets p^{a}(S\oplus(0^{\prime}\|K\|0^{c-k}))\) \(T^{*}\leftarrow\lceil S\rceil^{128}\oplus[K\rceil^{128})\) if\(T=T^{*}\)then \(F=P_{1}\|\ldots\|P_{t-1}\|\hat{P}_{t}\) else\(F=\perp\) endif Output:\(F\)
```
**Algorithm 6** Finalization process (verification of decryption)